registry / @mmerterden/multi-agent-pipeline / 20.15.1

@mmerterden/multi-agent-pipeline@20.15.1

6-phase AI development pipeline with full orchestration on Claude Code, Copilot CLI and Codex CLI. Analysis, planning, TDD, CLI-aware parallel review with consensus surfacing + Fable triage, default-FAIL evidence gates, secret + intent guards, per-phase c

AI Security Review

scanned 4d ago · by lpm-firewall-ai

Static inspection found no npm lifecycle hooks or concrete attack behavior. The flagged installer and agent configuration behavior is part of the explicitly invoked pipeline setup, while install telemetry is guarded by an affirmative opt-in.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

A user invokes the package install command to configure the pipeline for a host CLI.

Impact

The inspected behavior configures the requested product integration; no confirmed unauthorized collection, account action, or control-surface abuse was established.

Mechanism

The installer copies pipeline skills and configuration to host directories and registers the publisher’s companion toolkit; telemetry sends limited package and runtime metadata only when enabled by environment setting.

AI rationale

Evidence

package.jsonindex.jsinstall.jsinstall/index.mjsinstall/_plugin-skills.mjsinstall/_unattended-profile.mjsinstall/claude.mjsinstall/codex.mjspipeline/lib/agent-model-sync.mjspipeline/scripts/skill-conformance.mjspipeline/scripts/autopilot-awake.mjspipeline/skills/shared/external/swift-security/references/common-anti-patterns.mdpipeline/scripts/verify-citations.mjspipeline/scripts/usage-register.mjspipeline/scripts/localize-commands.mjspipeline/scripts/scenario-audit.mjs

Decision evidence

public snapshot

AI called this Clean at 90.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The manifest defines no install lifecycle hook; its start command launches the CLI entrypoint.
Agent setup runs through an explicit install command that dispatches to the selected host installer.
Install telemetry returns unless MULTI_AGENT_TELEMETRY is set to 1, and sends package and runtime metadata to the publisher endpoint.
The installer registers the publisher’s companion toolkit MCP server as part of the pipeline’s host integration.
The flagged sources serve bounded product functions: skill delivery, unattended settings, model sync, skill checks, citation validation, usage registration, command localization, scenario auditing, and awake-state management.
The secret-pattern finding is in security guidance that describes detection patterns; the inspected scenario-audit source describes fixed-string scenario searches.

Evidence against

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork

Source & flagged code

13 flagged

pipeline/skills/shared/external/swift-security/references/common-anti-patterns.mdView file

Lines 67-107markdown

67```

69Standards: MASTG-TEST-0300, MASTG-TEST-0302, MASWE-0006 (legacy MSTG-STORAGE-1).

71Detection: case-insensitive search of `.swift` files for lines containing `UserDefaults` together with token, password, secret, credential, auth, session, api key, jwt or bearer.

73```sh

75```

77## 2. Hardcoded API keys

79Severity: Critical. OWASP: M1. Fix effort: High.

81A Swift string literal ends up in the binary's `__TEXT.__cstring` section, where `strings` prints it in seconds. Values in `.xcconfig` files or `Info.plist` ship inside the IPA just the same. The 2025 scan mentioned above found about 78,800 keys for a single cloud provider's APIs alone.

83Insecure:

85```swift

86enum Secrets {

87 static let paymentsKey = "sk_live_EXAMPLEONLY000000000000"

Critical

Critical Secret

Package contains a critical-looking secret pattern.

pipeline/skills/shared/external/swift-security/references/common-anti-patterns.mdView on unpkg · L87

88 static let backendKey = "AIzaEXAMPLEONLY00000000000000000"

89}

90request.setValue("Bearer \(Secrets.paymentsKey)", forHTTPHeaderField: "Authorization")

91let plistKey = Bundle.main.infoDictionary?["API_KEY"] as? String

92```

94Secure, in order of preference:

961. A server-side proxy holds the key and the app calls the proxy, so the key never reaches the device.

972. If the device genuinely needs a key, fetch it at runtime from your server after the user or device is authenticated and cache it in the keychain.

99```swift

100func quoteShipment(_ order: ShipmentRequest) async throws -> Quote {

101 var request = URLRequest(url: quotesEndpoint)

102 request.httpMethod = "POST"

103 request.httpBody = try JSONEncoder().encode(order)

104 request.setValue("Bearer \(try await session.userAccessToken())", forHTTPHeaderField: "Authorization")

105 let (body, _) = try await URLSession.shared.data(for: request)

106 return try JSONDecoder().decode(Quote.self, from: body)

107}

87patternName = stripe_live_secret severity = critical line = 87

Critical

Secret Pattern

Stripe live secret key in pipeline/skills/shared/external/swift-security/references/common-anti-patterns.md

pipeline/skills/shared/external/swift-security/references/common-anti-patterns.mdView on unpkg · L87

pipeline/scripts/verify-citations.mjsView file

Lines 46-86javascript

46 * characters, or is the whole line. A line number with no quote only says

47 * the line exists; the quote says what the reviewer read on it;

48 * - every finding claimed pre-existing is checked against the base commit

49 * (_pre-existing.mjs);

pipeline/scripts/skill-conformance.mjs#virtual:normalized:round1View file

368// would be extracted into the manifest and injected into every reviewer L369: // prompt via the shared ${CRITERIA} block. Contain it to the skill"s own\n // directory; a declaration that escapes is recorded, not followed.\n const rulesPath = resolv... L370: // report a clean review over criteria it never loaded.

Medium

Dynamic Require

Package source references dynamic require/import behavior.

pipeline/scripts/skill-conformance.mjs#virtual:normalized:round1View on unpkg · L368

pipeline/scripts/build-stack-plugins.mjsView file

Lines 9-49javascript

9 * pipeline is the single authoring source; the marketplace is a derived, versioned

10 * publish artifact.

11 *

12 * The authored lifecycle skills (index / reference / workflow / tools) live in the

pipeline/scripts/autopilot-awake.mjsView file

Lines 2-42javascript

2/**

3 * autopilot-awake.mjs - the launchd job that keeps the Mac awake while

4 * autopilot is on.

5 *

6 * The schedule's StartInterval does not wake a sleeping Mac. The in-flight lock

7 * (`caffeinate -s -w <runner pid>`, _autopilot-ops.mjs) covers a run while it is

8 * going, and nothing covers the gap between ticks: the machine sleeps, the next

9 * tick never fires, and the queue stops with nothing to say so. This job closes

10 * that gap. It is a second, separate launchd agent that runs

pipeline/scripts/usage-register.mjs#virtual:normalized:round1View file

10* admin, no credential store: one status line, exit 0. L11: * - It never reports run CONTENT. That is usage-report.mjs"s contract, and it\n * is coarse metadata only.\n *\n * Usage:\n * node usage-register.mjs [--prefs <path>] [--json] ... L12: * name in `usageLog.trustedHosts`; http only to loopback (local development).

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

pipeline/scripts/usage-register.mjs#virtual:normalized:round1View on unpkg · L10

pipeline/scripts/localize-commands.mjsView file

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: eturn false; writefilesync(file, next); return true; } export function localizecommands(dir, mode) { if (!existssync(dir)) return 0; const files = []; const rootskill = join(dir, "skill.md"); if (existssync(rootskill)) files.push(rootskill); for (const entry of readdirsync(dir)) { const sub = join(dir, entry, "skill.md"); try { if (statsync(join(dir, entry)).isdirectory() && existssync(sub)) files.push(sub); } catch { } } let changed = 0; for (con

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

pipeline/scripts/localize-commands.mjsView on unpkg

pipeline/scripts/scenario-audit.mjs#virtual:normalized:round1View file

52contains invisible/control Unicode U+FEFF (zero width no-break space) const src = text.replace(new RegExp(`^${"<U+FEFF>"}`), "");

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

pipeline/scripts/scenario-audit.mjs#virtual:normalized:round1View on unpkg · L52

pipeline/scripts/github-ssh-setup.shView file

•path = pipeline/scripts/github-ssh-setup.sh kind = build_helper sizeBytes = 10099 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

pipeline/scripts/github-ssh-setup.shView on unpkg

install/_mcp-register.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 22

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

install/_mcp-register.mjs#virtual:normalized:round1View on unpkg

pipeline/scripts/keychain.pyView file

Lines 121-161python

121 info = doctor()

122 if not info["backend_ok"]:

123 sys.stderr.write(f"keychain: backend unavailable on {info['platform']}\n")

124 if info["remediation"]:

125 sys.stderr.write(f"keychain: {info['remediation']}\n")

126 sys.exit(2)

127 return info["platform"]

128

129

130def _decode_security_password(stderr: bytes) -> Optional[str]:

131 """Pull the secret out of `security ... -g` stderr and decode it.

132

Source & flagged code

13 flagged · loading source

pipeline/skills/shared/external/swift-security/references/common-anti-patterns.mdView file

87patternName = stripe_live_secret severity = critical line = 87

Critical

Critical Secret

Package contains a critical-looking secret pattern.

pipeline/skills/shared/external/swift-security/references/common-anti-patterns.mdView on unpkg · L87

87patternName = stripe_live_secret severity = critical line = 87

Critical

Secret Pattern

Stripe live secret key in pipeline/skills/shared/external/swift-security/references/common-anti-patterns.md

pipeline/skills/shared/external/swift-security/references/common-anti-patterns.mdView on unpkg · L87

pipeline/scripts/verify-citations.mjsView file

Findings

3 Critical5 High8 Medium5 Low

CriticalCritical Secretpipeline/skills/shared/external/swift-security/references/common-anti-patterns.md

CriticalTrojan Source Unicodepipeline/scripts/scenario-audit.mjs#virtual:normalized:round1

CriticalSecret Patternpipeline/skills/shared/external/swift-security/references/common-anti-patterns.md

HighChild Processpipeline/scripts/verify-citations.mjs

HighShell

HighSame File Env Network Executionpipeline/scripts/usage-register.mjs#virtual:normalized:round1

HighExternal Ai Agent Control Surface Mutationpipeline/scripts/localize-commands.mjs

HighSemantic Analysis Limitedinstall/_mcp-register.mjs#virtual:normalized:round1

MediumDynamic Requirepipeline/scripts/skill-conformance.mjs#virtual:normalized:round1

Affected versions and remediation

This report applies to @mmerterden/multi-agent-pipeline@20.15.1.

See all versions of @mmerterden/multi-agent-pipeline for other recorded verdicts.

Review the evidence and your use of @mmerterden/multi-agent-pipeline@20.15.1 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-19 13:06:38.938Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code