registry / @mmerterden/multi-agent-pipeline / 15.0.0

@mmerterden/multi-agent-pipeline@15.0.0

8-phase AI development pipeline with full orchestration on Claude Code, Copilot CLI and Codex CLI. Analysis, planning, TDD, CLI-aware parallel review with consensus surfacing + Fable triage, default-FAIL evidence gates, secret + intent guards, per-phase c

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

The package has real persistent AI-agent control-surface behavior, including MCP registration, so it warrants a warning under the extension-lifecycle policy. The behavior is user-invoked and source inspection found no concrete malicious chain.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Trigger

Running multi-agent-pipeline install (or invoking the bin with no command).

Impact

Persistent behavior-bearing configuration in ~/.claude, ~/.copilot, and ~/.codex; MCP registration launches @mmerterden/dev-toolkit-mcp through npx when used.

Mechanism

Copies agent assets, adds Claude hooks, and invokes host CLI MCP registration.

AI rationale

Evidence

package.jsonindex.jsinstall/index.mjsinstall/claude.mjsinstall/codex.mjsinstall/_mcp-register.mjsinstall/_telemetry.mjs~/.claude/commands~/.claude/settings.json~/.copilot~/.codex/AGENTS.md~/.codex/config.toml

Network endpoints1

mmerterden.vercel.app/api/install-notify

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Benign with low false-positive risk.

Evidence for warning

Explicit CLI install writes Claude/Copilot/Codex agent extensions.
Installer adds Claude PreToolUse shell hooks.
Installer registers an MCP server that runs another npm package via npx.
Opt-in telemetry POSTs basic install metadata to mmerterden.vercel.app.

Evidence against

package.json has no preinstall, install, or postinstall lifecycle hook.
Mutations occur only through the package CLI installer; dry-run and MCP-registration opt-out exist.
No source evidence of credential harvesting, covert exfiltration, obfuscated payloads, or destructive install-time behavior.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 66 file(s), 539 KB of source, external domains: github.com, mmerterden.vercel.app

Source & flagged code

6 flagged

pipeline/scripts/migrate-state.mjsView file

184try { L185: const mod = await import(pathToFileURL(step.path).href); L186: if (typeof mod.default !== "function") {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

pipeline/scripts/migrate-state.mjsView on unpkg · L184

pipeline/scripts/build-stack-plugins.mjsView file

22* L23: * Exit code 0 always (report-only); prints a JSON-ish summary + per-plugin diff. L24: */ ... L35: import { join } from "node:path"; L36: import { spawnSync } from "node:child_process"; L37: import { createHash } from "node:crypto"; ... L48: }; L49: const HOME = process.env.HOME; L50: const PLUGINS_REPO = getArg("--plugins-repo", join(HOME, "multi-agent-plugins")); ... L213: // regenerate plugin.json skills[]: keep non-knowledge entries, rebuild knowledge set L214: const pj = JSON.parse(readFileSync(pjPath, "utf8")); L215: const nonKnowledge = (pj.skills || []).filter((s) => !s.startsWith("./skills/knowledge/"));

Low

Weak Crypto

Package source references weak cryptographic algorithms.

pipeline/scripts/build-stack-plugins.mjsView on unpkg · L22

pipeline/scripts/localize-commands.mjsView file

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: alse; const envalue = lines[enidx].match(desc_en)[1]; lines[descidx] = `description: ${envalue}`; lines.splice(enidx, 1); } const next = lines.join("\n"); if (next === original) return false; writefilesync(file, next); return true; } export function localizecommands(dir, mode) { if (!existssync(dir)) return 0; const files = []; const rootskill = join(dir, "skill.md"); if (existssync(rootskill)) files.push(rootskill); for (const entry of readdirsync(dir)) { const sub = join(dir, entry,

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

pipeline/scripts/localize-commands.mjsView on unpkg

pipeline/scripts/github-ssh-setup.shView file

•path = pipeline/scripts/github-ssh-setup.sh kind = build_helper sizeBytes = 2634 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

pipeline/scripts/github-ssh-setup.shView on unpkg

pipeline/scripts/check-derived-drift.mjsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 4

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

pipeline/scripts/check-derived-drift.mjsView on unpkg

pipeline/scripts/diff-explain.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @mmerterden/multi-agent-pipeline@13.2.0 matchedIdentity = npm:[redacted]:13.2.0 similarity = 0.610 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

pipeline/scripts/diff-explain.mjsView on unpkg

Source & flagged code

6 flagged · loading source

pipeline/scripts/migrate-state.mjsView file

184try { L185: const mod = await import(pathToFileURL(step.path).href); L186: if (typeof mod.default !== "function") {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

pipeline/scripts/migrate-state.mjsView on unpkg · L184

pipeline/scripts/build-stack-plugins.mjsView file

Low

Weak Crypto

Package source references weak cryptographic algorithms.

pipeline/scripts/build-stack-plugins.mjsView on unpkg · L22

Findings

3 High5 Medium5 Low

HighExternal Ai Agent Control Surface Mutationpipeline/scripts/localize-commands.mjs

HighSemantic Analysis Limitedpipeline/scripts/check-derived-drift.mjs

HighPrevious Version Dangerous Deltapipeline/scripts/diff-explain.mjs

MediumDynamic Requirepipeline/scripts/migrate-state.mjs

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperpipeline/scripts/github-ssh-setup.sh

MediumStructural Risk Force Deep Review

LowScripts Present

LowWeak Cryptopipeline/scripts/build-stack-plugins.mjs

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @mmerterden/multi-agent-pipeline@15.0.0.

See all versions of @mmerterden/multi-agent-pipeline for other recorded verdicts.

Review the evidence and your use of @mmerterden/multi-agent-pipeline@15.0.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-08-15 11:21:20.051Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code