registry / @mmerterden/multi-agent-pipeline / 15.9.1
@mmerterden/multi-agent-pipeline@15.9.1
⚠ Under review8-phase AI development pipeline with full orchestration on Claude Code, Copilot CLI and Codex CLI. Analysis, planning, TDD, CLI-aware parallel review with consensus surfacing + Fable triage, default-FAIL evidence gates, secret + intent guards, per-phase c
Static Scan Results
scanned 22d ago · by rust-scannerStatic analysis completed at 65.0% confidence. No malicious behavior was detected; 11 low-signal pattern(s) were surfaced and cleared.
Static reason
No blocking static signals were detected.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
4 flagged · loading sourcepipeline/scripts/skill-conformance.mjs#virtual:normalized:round1View file
365// would be extracted into the manifest and injected into every reviewer
L366: // prompt via the shared ${CRITERIA} block. Contain it to the skill"s own\n // directory; a declaration that escapes is recorded, not followed.\n const rulesPath = resolv...
L367: // report a clean review over criteria it never loaded.
Medium
Dynamic Require
Package source references dynamic require/import behavior.
pipeline/scripts/skill-conformance.mjs#virtual:normalized:round1View on unpkg · L365pipeline/scripts/build-stack-plugins.mjsView file
22*
L23: * Exit code 0 always (report-only); prints a JSON-ish summary + per-plugin diff.
L24: */
...
L35: import { join } from "node:path";
L36: import { spawnSync } from "node:child_process";
L37: import { createHash } from "node:crypto";
...
L60: // gets a string instead of throwing a raw TypeError before any diagnostic.
L61: const HOME = process.env.HOME || process.env.USERPROFILE;
L62: if (!HOME) {
...
L245: // regenerate plugin.json skills[]: keep non-knowledge entries, rebuild knowledge set
L246: const pj = JSON.parse(readFileSync(pjPath, "utf8"));
L247: const nonKnowledge = (pj.skills || []).filter((s) => !s.startsWith("./skills/knowledge/"));
Findings
1 High5 Medium5 Low
HighSemantic Analysis Limitedinstall/codex.mjs#virtual:normalized:round1
MediumDynamic Requirepipeline/scripts/skill-conformance.mjs#virtual:normalized:round1
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperpipeline/scripts/github-ssh-setup.sh
MediumStructural Risk Force Deep Review
LowScripts Present
LowWeak Cryptopipeline/scripts/build-stack-plugins.mjs
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @mmerterden/multi-agent-pipeline@15.9.1.
See all versions of @mmerterden/multi-agent-pipeline for other recorded verdicts.
- Review the evidence and your use of @mmerterden/multi-agent-pipeline@15.9.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.