registry / @mmerterden/multi-agent-pipeline / 11.3.1

@mmerterden/multi-agent-pipeline@11.3.1

8-phase AI development pipeline with full orchestration on Claude Code and Copilot CLI. Analysis, planning, TDD, CLI-aware parallel review with consensus surfacing + Fable triage, default-FAIL evidence gates, secret + intent guards, per-phase cost ledger,

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 25 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 56 file(s), 333 KB of source, external domains: github.com, mmerterden.vercel.app

Source & flagged code

18 flagged

pipeline/scripts/smoke-pre-commit.shView file

Lines 61-121shell

62check_passes() {

63 local desc="$1" filename="$2" content="$3"

64 reset_stage

65 stage_and_check "$filename" "$content"

66 if run_hook; then

67 pass "$desc"

68 else

69 fail "$desc (hook blocked, expected pass)"

70 fi

71}

73echo "→ 1. Secret pattern detection"

75check_detects "API key (api_key=long_string)" \

76 "test-file.swift" \

77 'let api_key = "ghp_aBcDeFgHiJkLmNoPqRsT1234567890"'

79check_detects "AWS access key (AKIA prefix)" \

80 "test-file.py" \

81 'aws_key = "AKIAIOSFODNN7EXAMPLE"'

Critical

Critical Secret

Package contains a critical-looking secret pattern.

pipeline/scripts/smoke-pre-commit.shView on unpkg · L81

Critical

Secret Pattern

AWS access key ID in pipeline/scripts/smoke-pre-commit.sh

pipeline/scripts/smoke-pre-commit.shView on unpkg · L81

83check_detects "RSA private key header" \

84 "test-file.pem" \

85 '-----BEGIN RSA PRIVATE KEY-----'

Critical

Secret Pattern

RSA private key in pipeline/scripts/smoke-pre-commit.sh

pipeline/scripts/smoke-pre-commit.shView on unpkg · L85

87check_detects "Generic private key header" \

88 "test-file.key" \

89 '-----BEGIN PRIVATE KEY-----'

Critical

Secret Pattern

RSA private key in pipeline/scripts/smoke-pre-commit.sh

pipeline/scripts/smoke-pre-commit.shView on unpkg · L89

91check_detects "EC private key header" \

92 "test-file.key" \

93 '-----BEGIN EC PRIVATE KEY-----'

Critical

Secret Pattern

EC private key in pipeline/scripts/smoke-pre-commit.sh

pipeline/scripts/smoke-pre-commit.shView on unpkg · L93

95check_detects "GCP service account JSON" \

96 "test-file.json" \

97 '{"type": "service_account", "project_id": "my-project"}'

99check_detects "GitHub PAT (ghp_ 36 chars)" \

100 "test-file.txt" \

101 'token: ghp_aBcDeFgHiJkLmNoPqRsTuVwXyZ0123456789'

Critical

Secret Pattern

GitHub personal access token in pipeline/scripts/smoke-pre-commit.sh

pipeline/scripts/smoke-pre-commit.shView on unpkg · L101

102

103check_detects "Slack token (xoxb-)" \

104 "test-file.txt" \

105 'slack = "xoxb-123456789012-abcdefghijklmnop"'

106

107check_detects "Google API key (AIza)" \

108 "test-file.txt" \

109 'gmaps = "AIzaSyA1234567890abcdefghijklmnopqrstuv"'

110

111check_detects "JWT three-segment token" \

112 "test-file.txt" \

113 'auth = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.dozjgNryP4J3jVmNHl0w5N"'

114

115check_detects "High-entropy custom secret (no known prefix)" \

116 "test-file.txt" \

117 'session = "Zx9Kq2Lm7Pw4Nv8Rt3Yb6Hc1Df5Gj0Sa2Wd7Qe4Uo9Ik"'

118

119check_detects "Secret in a filename WITH SPACES (no false-negative)" \

120 "test secret file.txt" \

121 'token: ghp_aBcDeFgHiJkLmNoPqRsTuVwXyZ0123456789'

121patternName = github_pat severity = critical line = 121 matchedText = 'token: ...789'

Critical

Secret Pattern

GitHub personal access token in pipeline/scripts/smoke-pre-commit.sh

pipeline/scripts/smoke-pre-commit.shView on unpkg · L121

109patternName = google_api_key severity = high line = 109 matchedText = 'gmaps =...uv"'

High

Secret Pattern

Google API key in pipeline/scripts/smoke-pre-commit.sh

pipeline/scripts/smoke-pre-commit.shView on unpkg · L109

pipeline/scripts/migrate-state.mjsView file

Lines 164-204javascript

164 process.exit(1);

165 }

166

167 if (from === to) {

168 console.log(`${path} already at schemaVersion ${to} - no migration needed`);

169 process.exit(0);

170 }

install/_telemetry.mjsView file

Lines 1-29javascript

1/**

2 * Anonymous install telemetry (opt-in only).

3 *

4 * Set `MULTI_AGENT_TELEMETRY=1` to enable. Nothing is sent otherwise.

5 * Fire-and-forget; never throws and never delays the install.

6 *

7 * @module install/_telemetry

8 */

10import { execSync } from "child_process";

pipeline/scripts/smoke-md2confluence.shView file

•path = pipeline/scripts/smoke-md2confluence.sh kind = build_helper sizeBytes = 3800 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

pipeline/scripts/smoke-md2confluence.shView on unpkg

pipeline/scripts/lint-skills.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @mmerterden/multi-agent-pipeline@11.3.0 matchedIdentity = npm:[redacted]:11.3.0 similarity = 0.909 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

pipeline/scripts/lint-skills.mjsView on unpkg

pipeline/skills/shared/external/swift-security/references/cryptokit-symmetric.mdView file

309patternName = generic_password severity = medium line = 309 matchedText = let pass...123"

Medium

Secret Pattern

Hardcoded password in pipeline/skills/shared/external/swift-security/references/cryptokit-symmetric.md

pipeline/skills/shared/external/swift-security/references/cryptokit-symmetric.mdView on unpkg · L309

pipeline/skills/shared/external/swift-security/references/cryptokit-public-key.mdView file

359patternName = private_key_rsa severity = critical line = 359 matchedText = CryptoKi...ies.

Critical

Secret Pattern

RSA private key in pipeline/skills/shared/external/swift-security/references/cryptokit-public-key.md

pipeline/skills/shared/external/swift-security/references/cryptokit-public-key.mdView on unpkg · L359

359patternName = private_key_ec severity = critical line = 359 matchedText = CryptoKi...ies.

Critical

Secret Pattern

EC private key in pipeline/skills/shared/external/swift-security/references/cryptokit-public-key.md

pipeline/skills/shared/external/swift-security/references/cryptokit-public-key.mdView on unpkg · L359

pipeline/skills/shared/external/swift-security/references/keychain-sharing.mdView file

142patternName = generic_password severity = medium line = 142 matchedText = let pass...f8)!

Medium

Secret Pattern

Hardcoded password in pipeline/skills/shared/external/swift-security/references/keychain-sharing.md

pipeline/skills/shared/external/swift-security/references/keychain-sharing.mdView on unpkg · L142

pipeline/skills/shared/external/swift-testing/references/testing-patterns.mdView file

437patternName = generic_password severity = medium line = 437 matchedText = let home...rd")

Medium

Secret Pattern

Hardcoded password in pipeline/skills/shared/external/swift-testing/references/testing-patterns.md

pipeline/skills/shared/external/swift-testing/references/testing-patterns.mdView on unpkg · L437

pipeline/skills/shared/external/web-testing/SKILL.mdView file

162patternName = generic_password severity = medium line = 162 matchedText = password...23',

Medium

Secret Pattern

Hardcoded password in pipeline/skills/shared/external/web-testing/SKILL.md

pipeline/skills/shared/external/web-testing/SKILL.mdView on unpkg · L162

Source & flagged code

18 flagged · loading source

pipeline/scripts/smoke-pre-commit.shView file

81patternName = aws_access_key severity = critical line = 81 matchedText = 'aws_key...LE"'

Critical

Critical Secret

Package contains a critical-looking secret pattern.

pipeline/scripts/smoke-pre-commit.shView on unpkg · L81

81patternName = aws_access_key severity = critical line = 81 matchedText = 'aws_key...LE"'

Critical

Secret Pattern

AWS access key ID in pipeline/scripts/smoke-pre-commit.sh

pipeline/scripts/smoke-pre-commit.shView on unpkg · L81

85patternName = private_key_rsa severity = critical line = 85 matchedText = '-----BE...---'

Critical

Secret Pattern

RSA private key in pipeline/scripts/smoke-pre-commit.sh

pipeline/scripts/smoke-pre-commit.shView on unpkg · L85

89patternName = private_key_rsa severity = critical line = 89 matchedText = '-----BE...---'

Critical

Secret Pattern

RSA private key in pipeline/scripts/smoke-pre-commit.sh

pipeline/scripts/smoke-pre-commit.shView on unpkg · L89

93patternName = private_key_ec severity = critical line = 93 matchedText = '-----BE...---'

Critical

Secret Pattern

EC private key in pipeline/scripts/smoke-pre-commit.sh

pipeline/scripts/smoke-pre-commit.shView on unpkg · L93

101patternName = github_pat severity = critical line = 101 matchedText = 'token: ...789'

Critical

Secret Pattern

GitHub personal access token in pipeline/scripts/smoke-pre-commit.sh

pipeline/scripts/smoke-pre-commit.shView on unpkg · L101

121patternName = github_pat severity = critical line = 121 matchedText = 'token: ...789'

Critical

Secret Pattern

GitHub personal access token in pipeline/scripts/smoke-pre-commit.sh

pipeline/scripts/smoke-pre-commit.shView on unpkg · L121

109patternName = google_api_key severity = high line = 109 matchedText = 'gmaps =...uv"'

High

Secret Pattern

Google API key in pipeline/scripts/smoke-pre-commit.sh

pipeline/scripts/smoke-pre-commit.shView on unpkg · L109

pipeline/scripts/migrate-state.mjsView file

184try { L185: const mod = await import(pathToFileURL(step.path).href); L186: if (typeof mod.default !== "function") {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

pipeline/scripts/migrate-state.mjsView on unpkg · L184

install/_telemetry.mjsView file

9L10: import { execSync } from "child_process"; L11: import { readFileSync } from "fs"; ... L15: /** L16: * Run a shell command silently and return its trimmed stdout, or undefined on error. L17: * @param {string} cmd ... L34: export async function sendInstallTelemetry(ctx) { L35: if (process.env.MULTI_AGENT_TELEMETRY !== "1") return; L36: ... L40: else if (process.env.npm[redacted] === "true") method = "global"; L41: else if (process.env.npm[redacted] === "install") method = "npm-install"; L42:

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

install/_telemetry.mjsView on unpkg · L9

pipeline/scripts/smoke-md2confluence.shView file

•path = pipeline/scripts/smoke-md2confluence.sh kind = build_helper sizeBytes = 3800 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

pipeline/scripts/smoke-md2confluence.shView on unpkg

pipeline/scripts/lint-skills.mjsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

pipeline/scripts/lint-skills.mjsView on unpkg

pipeline/skills/shared/external/swift-security/references/cryptokit-symmetric.mdView file

309patternName = generic_password severity = medium line = 309 matchedText = let pass...123"

Medium

Secret Pattern

Hardcoded password in pipeline/skills/shared/external/swift-security/references/cryptokit-symmetric.md

pipeline/skills/shared/external/swift-security/references/cryptokit-symmetric.mdView on unpkg · L309

pipeline/skills/shared/external/swift-security/references/cryptokit-public-key.mdView file

359patternName = private_key_rsa severity = critical line = 359 matchedText = CryptoKi...ies.

Critical

Secret Pattern

RSA private key in pipeline/skills/shared/external/swift-security/references/cryptokit-public-key.md

pipeline/skills/shared/external/swift-security/references/cryptokit-public-key.mdView on unpkg · L359

359patternName = private_key_ec severity = critical line = 359 matchedText = CryptoKi...ies.

Critical

Secret Pattern

EC private key in pipeline/skills/shared/external/swift-security/references/cryptokit-public-key.md

pipeline/skills/shared/external/swift-security/references/cryptokit-public-key.mdView on unpkg · L359

pipeline/skills/shared/external/swift-security/references/keychain-sharing.mdView file

142patternName = generic_password severity = medium line = 142 matchedText = let pass...f8)!

Medium

Secret Pattern

Hardcoded password in pipeline/skills/shared/external/swift-security/references/keychain-sharing.md

pipeline/skills/shared/external/swift-security/references/keychain-sharing.mdView on unpkg · L142

pipeline/skills/shared/external/swift-testing/references/testing-patterns.mdView file

437patternName = generic_password severity = medium line = 437 matchedText = let home...rd")

Medium

Secret Pattern

Hardcoded password in pipeline/skills/shared/external/swift-testing/references/testing-patterns.md

pipeline/skills/shared/external/swift-testing/references/testing-patterns.mdView on unpkg · L437

pipeline/skills/shared/external/web-testing/SKILL.mdView file

162patternName = generic_password severity = medium line = 162 matchedText = password...23',

Medium

Secret Pattern

Hardcoded password in pipeline/skills/shared/external/web-testing/SKILL.md

pipeline/skills/shared/external/web-testing/SKILL.mdView on unpkg · L162

Findings

9 Critical3 High9 Medium4 Low

CriticalCritical Secretpipeline/scripts/smoke-pre-commit.sh

CriticalSecret Patternpipeline/scripts/smoke-pre-commit.sh

CriticalSecret Patternpipeline/skills/shared/external/swift-security/references/cryptokit-public-key.md

HighSandbox Evasion Gated Capabilityinstall/_telemetry.mjs

HighPrevious Version Dangerous Deltapipeline/scripts/lint-skills.mjs

HighSecret Patternpipeline/scripts/smoke-pre-commit.sh

MediumDynamic Requirepipeline/scripts/migrate-state.mjs

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperpipeline/scripts/smoke-md2confluence.sh

MediumStructural Risk Force Deep Review

MediumSecret Patternpipeline/skills/shared/external/swift-security/references/cryptokit-symmetric.md

MediumSecret Patternpipeline/skills/shared/external/swift-security/references/keychain-sharing.md

MediumSecret Patternpipeline/skills/shared/external/swift-testing/references/testing-patterns.md

MediumSecret Patternpipeline/skills/shared/external/web-testing/SKILL.md

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

18 flagged

pipeline/scripts/smoke-pre-commit.shView file

Lines 61-121shell

62check_passes() {

63 local desc="$1" filename="$2" content="$3"

64 reset_stage

65 stage_and_check "$filename" "$content"

66 if run_hook; then

67 pass "$desc"

68 else

69 fail "$desc (hook blocked, expected pass)"

70 fi

71}

73echo "→ 1. Secret pattern detection"

75check_detects "API key (api_key=long_string)" \

76 "test-file.swift" \

77 'let api_key = "ghp_aBcDeFgHiJkLmNoPqRsT1234567890"'

79check_detects "AWS access key (AKIA prefix)" \

80 "test-file.py" \

81 'aws_key = "AKIAIOSFODNN7EXAMPLE"'

Critical

Critical Secret

Package contains a critical-looking secret pattern.

pipeline/scripts/smoke-pre-commit.shView on unpkg · L81

Critical

Secret Pattern

AWS access key ID in pipeline/scripts/smoke-pre-commit.sh

pipeline/scripts/smoke-pre-commit.shView on unpkg · L81

83check_detects "RSA private key header" \

84 "test-file.pem" \

85 '-----BEGIN RSA PRIVATE KEY-----'

Critical

Secret Pattern

RSA private key in pipeline/scripts/smoke-pre-commit.sh

pipeline/scripts/smoke-pre-commit.shView on unpkg · L85

87check_detects "Generic private key header" \

88 "test-file.key" \

89 '-----BEGIN PRIVATE KEY-----'

Critical

Secret Pattern

RSA private key in pipeline/scripts/smoke-pre-commit.sh

pipeline/scripts/smoke-pre-commit.shView on unpkg · L89

91check_detects "EC private key header" \

92 "test-file.key" \

93 '-----BEGIN EC PRIVATE KEY-----'

Critical

Secret Pattern

EC private key in pipeline/scripts/smoke-pre-commit.sh

pipeline/scripts/smoke-pre-commit.shView on unpkg · L93

95check_detects "GCP service account JSON" \

96 "test-file.json" \

97 '{"type": "service_account", "project_id": "my-project"}'

99check_detects "GitHub PAT (ghp_ 36 chars)" \

100 "test-file.txt" \

101 'token: ghp_aBcDeFgHiJkLmNoPqRsTuVwXyZ0123456789'

Critical

Secret Pattern

GitHub personal access token in pipeline/scripts/smoke-pre-commit.sh

pipeline/scripts/smoke-pre-commit.shView on unpkg · L101

102

103check_detects "Slack token (xoxb-)" \

104 "test-file.txt" \

105 'slack = "xoxb-123456789012-abcdefghijklmnop"'

106

107check_detects "Google API key (AIza)" \

108 "test-file.txt" \

109 'gmaps = "AIzaSyA1234567890abcdefghijklmnopqrstuv"'

110

111check_detects "JWT three-segment token" \

112 "test-file.txt" \

113 'auth = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.dozjgNryP4J3jVmNHl0w5N"'

114

115check_detects "High-entropy custom secret (no known prefix)" \

116 "test-file.txt" \

117 'session = "Zx9Kq2Lm7Pw4Nv8Rt3Yb6Hc1Df5Gj0Sa2Wd7Qe4Uo9Ik"'

118

119check_detects "Secret in a filename WITH SPACES (no false-negative)" \

120 "test secret file.txt" \

121 'token: ghp_aBcDeFgHiJkLmNoPqRsTuVwXyZ0123456789'

121patternName = github_pat severity = critical line = 121 matchedText = 'token: ...789'

Critical

Secret Pattern

GitHub personal access token in pipeline/scripts/smoke-pre-commit.sh

pipeline/scripts/smoke-pre-commit.shView on unpkg · L121

109patternName = google_api_key severity = high line = 109 matchedText = 'gmaps =...uv"'

High

Secret Pattern

Google API key in pipeline/scripts/smoke-pre-commit.sh

pipeline/scripts/smoke-pre-commit.shView on unpkg · L109

pipeline/scripts/migrate-state.mjsView file

Lines 164-204javascript

164 process.exit(1);

165 }

166

167 if (from === to) {

168 console.log(`${path} already at schemaVersion ${to} - no migration needed`);

169 process.exit(0);

170 }

install/_telemetry.mjsView file

Lines 1-29javascript

1/**

2 * Anonymous install telemetry (opt-in only).

3 *

4 * Set `MULTI_AGENT_TELEMETRY=1` to enable. Nothing is sent otherwise.

5 * Fire-and-forget; never throws and never delays the install.

6 *

7 * @module install/_telemetry

8 */

10import { execSync } from "child_process";

pipeline/scripts/smoke-md2confluence.shView file

•path = pipeline/scripts/smoke-md2confluence.sh kind = build_helper sizeBytes = 3800 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

pipeline/scripts/smoke-md2confluence.shView on unpkg

pipeline/scripts/lint-skills.mjsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

pipeline/scripts/lint-skills.mjsView on unpkg

pipeline/skills/shared/external/swift-security/references/cryptokit-symmetric.mdView file

309patternName = generic_password severity = medium line = 309 matchedText = let pass...123"

Medium

Secret Pattern

Hardcoded password in pipeline/skills/shared/external/swift-security/references/cryptokit-symmetric.md

pipeline/skills/shared/external/swift-security/references/cryptokit-symmetric.mdView on unpkg · L309

pipeline/skills/shared/external/swift-security/references/cryptokit-public-key.mdView file

359patternName = private_key_rsa severity = critical line = 359 matchedText = CryptoKi...ies.

Critical

Secret Pattern

RSA private key in pipeline/skills/shared/external/swift-security/references/cryptokit-public-key.md

pipeline/skills/shared/external/swift-security/references/cryptokit-public-key.mdView on unpkg · L359

359patternName = private_key_ec severity = critical line = 359 matchedText = CryptoKi...ies.

Critical

Secret Pattern

EC private key in pipeline/skills/shared/external/swift-security/references/cryptokit-public-key.md

pipeline/skills/shared/external/swift-security/references/cryptokit-public-key.mdView on unpkg · L359

pipeline/skills/shared/external/swift-security/references/keychain-sharing.mdView file

142patternName = generic_password severity = medium line = 142 matchedText = let pass...f8)!

Medium

Secret Pattern

Hardcoded password in pipeline/skills/shared/external/swift-security/references/keychain-sharing.md

pipeline/skills/shared/external/swift-security/references/keychain-sharing.mdView on unpkg · L142

pipeline/skills/shared/external/swift-testing/references/testing-patterns.mdView file

437patternName = generic_password severity = medium line = 437 matchedText = let home...rd")

Medium

Secret Pattern

Hardcoded password in pipeline/skills/shared/external/swift-testing/references/testing-patterns.md

pipeline/skills/shared/external/swift-testing/references/testing-patterns.mdView on unpkg · L437

pipeline/skills/shared/external/web-testing/SKILL.mdView file

162patternName = generic_password severity = medium line = 162 matchedText = password...23',

Medium

Secret Pattern

Hardcoded password in pipeline/skills/shared/external/web-testing/SKILL.md

pipeline/skills/shared/external/web-testing/SKILL.mdView on unpkg · L162