registry / @ikon85/agent-workflow-kit / 0.28.0

@ikon85/agent-workflow-kit@0.28.0

Portable AI-agent workflow skills (plan → execute → land → learn) for Claude Code & Codex — grilling, TDD, diagnosis, two-axis code review, cross-model Codex review, design & domain-modeling, plus a skill router (ask-matt). npx init/update/diff/uninstall.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 56 file(s), 231 KB of source, external domains: github.com, testreporter.iverra.de

Source & flagged code

4 flagged

scripts/test_census_update_contract.test.mjsView file

Lines 1-22javascript

1import { test } from 'node:test';

2import assert from 'node:assert/strict';

3import { execFile } from 'node:child_process';

4import { promisify } from 'node:util';

High

Child Process

Package source references child process execution.

scripts/test_census_update_contract.test.mjsView on unpkg · L2

5import { access, lstat, mkdtemp, mkdir, readFile, realpath, rm, stat, symlink, writeFile } from 'node:fs/promises';

6import { tmpdir } from 'node:os';

7import { basename, isAbsolute, join, relative, resolve, sep } from 'node:path';

8import { pathToFileURL } from 'node:url';

9import {

10 CENSUS_VERDICTS,

11 activateCensus,

12 diffCensus,

13 fingerprintCensus,

14 resolveCensusState,

15 scanCensus,

16 serializeCensus,

17} from './census/index.mjs';

19const ROOT = new URL('../', import.meta.url);

20const exec = promisify(execFile);

22async function text(path) {

scripts/build-kit.test.mjsView file

Lines 113-153javascript

113 const ownedLogDir = await mkdtemp(join(logsDir, 'pack-runtime-'));

114 const runtimeLog = join(ownedLogDir, 'drift-guard.log');

.agents/skills/diagnose/scripts/hitl-loop.template.shView file

•path = .[redacted]-loop.template.sh kind = payload_in_excluded_dir sizeBytes = 1164 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.agents/skills/diagnose/scripts/hitl-loop.template.shView on unpkg

•path = .[redacted]-loop.template.sh kind = build_helper sizeBytes = 1164 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

.agents/skills/diagnose/scripts/hitl-loop.template.shView on unpkg

Source & flagged code

4 flagged · loading source

scripts/test_census_update_contract.test.mjsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code