registry / @mmerterden/multi-agent-pipeline / 20.16.0

@mmerterden/multi-agent-pipeline@20.16.0

6-phase AI development pipeline with full orchestration on Claude Code, Copilot CLI and Codex CLI. Analysis, planning, TDD, CLI-aware parallel review with consensus surfacing + Fable triage, default-FAIL evidence gates, secret + intent guards, per-phase c

AI Security Review

scanned 11d ago · by lpm-firewall-ai

Source inspection found no npm install lifecycle hook or concrete malicious behavior. The flagged agent-related operations are setup or utility behavior reached through explicit invocation, and the telemetry code is opt-in.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

A user invokes the package CLI or an exposed utility directly.

Impact

The inspected behavior supports the package's stated pipeline and setup functions; no confirmed malicious effect or attack surface remains.

Mechanism

The installer deploys package components to supported agent directories; the inspected localization utility edits command descriptions. The unattended profile is separately selected by an installer flag.

AI rationale

Decision evidence

public snapshot

AI called this Clean at 88.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json defines a CLI entry and development scripts; it contains no npm install lifecycle hook.
The installer is explicitly invoked through its CLI and writes files into supported agent-specific directories.
The unattended profile is a separate setting and its changes are gated by an explicit installer option.
The flagged localization code changes command description text; model-sync has a direct-invocation guard, and plugin/conformance code locates plugin skill files.
The flagged verification and scenario scripts check repository evidence; the reported secret-pattern file is security guidance.

Evidence against

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

Source & flagged code

13 flagged

pipeline/skills/shared/external/swift-security/references/common-anti-patterns.mdView file

Lines 67-107markdown

67```

69Standards: MASTG-TEST-0300, MASTG-TEST-0302, MASWE-0006 (legacy MSTG-STORAGE-1).

71Detection: case-insensitive search of `.swift` files for lines containing `UserDefaults` together with token, password, secret, credential, auth, session, api key, jwt or bearer.

73```sh

75```

77## 2. Hardcoded API keys

79Severity: Critical. OWASP: M1. Fix effort: High.

81A Swift string literal ends up in the binary's `__TEXT.__cstring` section, where `strings` prints it in seconds. Values in `.xcconfig` files or `Info.plist` ship inside the IPA just the same. The 2025 scan mentioned above found about 78,800 keys for a single cloud provider's APIs alone.

83Insecure:

85```swift

86enum Secrets {

87 static let paymentsKey = "sk_live_EXAMPLEONLY000000000000"

Critical

Critical Secret

Package contains a critical-looking secret pattern.

pipeline/skills/shared/external/swift-security/references/common-anti-patterns.mdView on unpkg · L87

88 static let backendKey = "AIzaEXAMPLEONLY00000000000000000"

89}

90request.setValue("Bearer \(Secrets.paymentsKey)", forHTTPHeaderField: "Authorization")

91let plistKey = Bundle.main.infoDictionary?["API_KEY"] as? String

92```

94Secure, in order of preference:

961. A server-side proxy holds the key and the app calls the proxy, so the key never reaches the device.

972. If the device genuinely needs a key, fetch it at runtime from your server after the user or device is authenticated and cache it in the keychain.

99```swift

100func quoteShipment(_ order: ShipmentRequest) async throws -> Quote {

101 var request = URLRequest(url: quotesEndpoint)

102 request.httpMethod = "POST"

103 request.httpBody = try JSONEncoder().encode(order)

104 request.setValue("Bearer \(try await session.userAccessToken())", forHTTPHeaderField: "Authorization")

105 let (body, _) = try await URLSession.shared.data(for: request)

106 return try JSONDecoder().decode(Quote.self, from: body)

107}

87patternName = stripe_live_secret severity = critical line = 87

Critical

Secret Pattern

Stripe live secret key in pipeline/skills/shared/external/swift-security/references/common-anti-patterns.md

pipeline/skills/shared/external/swift-security/references/common-anti-patterns.mdView on unpkg · L87

pipeline/scripts/verify-citations.mjsView file

Lines 46-86javascript

46 * characters, or is the whole line. A line number with no quote only says

47 * the line exists; the quote says what the reviewer read on it;

48 * - every finding claimed pre-existing is checked against the base commit

49 * (_pre-existing.mjs);

pipeline/scripts/skill-conformance.mjs#virtual:normalized:round1View file

368// would be extracted into the manifest and injected into every reviewer L369: // prompt via the shared ${CRITERIA} block. Contain it to the skill"s own\n // directory; a declaration that escapes is recorded, not followed.\n const rulesPath = resolv... L370: // report a clean review over criteria it never loaded.

Medium

Dynamic Require

Package source references dynamic require/import behavior.

pipeline/scripts/skill-conformance.mjs#virtual:normalized:round1View on unpkg · L368

pipeline/scripts/build-stack-plugins.mjsView file

Lines 9-49javascript

9 * pipeline is the single authoring source; the marketplace is a derived, versioned

10 * publish artifact.

11 *

12 * The authored lifecycle skills (index / reference / workflow / tools) live in the

pipeline/scripts/autopilot-awake.mjsView file

Lines 2-42javascript

2/**

3 * autopilot-awake.mjs - the launchd job that keeps the Mac awake while

4 * autopilot is on.

5 *

6 * The schedule's StartInterval does not wake a sleeping Mac. The in-flight lock

7 * (`caffeinate -s -w <runner pid>`, _autopilot-ops.mjs) covers a run while it is

8 * going, and nothing covers the gap between ticks: the machine sleeps, the next

9 * tick never fires, and the queue stops with nothing to say so. This job closes

10 * that gap. It is a second, separate launchd agent that runs

pipeline/scripts/usage-register.mjs#virtual:normalized:round1View file

10* admin, no credential store: one status line, exit 0. L11: * - It never reports run CONTENT. That is usage-report.mjs"s contract, and it\n * is coarse metadata only.\n *\n * Usage:\n * node usage-register.mjs [--prefs <path>] [--json] ... L12: * name in `usageLog.trustedHosts`; http only to loopback (local development).

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

pipeline/scripts/usage-register.mjs#virtual:normalized:round1View on unpkg · L10

pipeline/scripts/localize-commands.mjsView file

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: eturn false; writefilesync(file, next); return true; } export function localizecommands(dir, mode) { if (!existssync(dir)) return 0; const files = []; const rootskill = join(dir, "skill.md"); if (existssync(rootskill)) files.push(rootskill); for (const entry of readdirsync(dir)) { const sub = join(dir, entry, "skill.md"); try { if (statsync(join(dir, entry)).isdirectory() && existssync(sub)) files.push(sub); } catch { } } let changed = 0; for (con

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

pipeline/scripts/localize-commands.mjsView on unpkg

pipeline/scripts/scenario-audit.mjs#virtual:normalized:round1View file

52contains invisible/control Unicode U+FEFF (zero width no-break space) const src = text.replace(new RegExp(`^${"<U+FEFF>"}`), "");

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

pipeline/scripts/scenario-audit.mjs#virtual:normalized:round1View on unpkg · L52

pipeline/scripts/github-ssh-setup.shView file

•path = pipeline/scripts/github-ssh-setup.sh kind = build_helper sizeBytes = 10099 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

pipeline/scripts/github-ssh-setup.shView on unpkg

install/_mcp-register.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 22

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

install/_mcp-register.mjs#virtual:normalized:round1View on unpkg

pipeline/scripts/keychain.pyView file

Lines 121-161python

121 info = doctor()

122 if not info["backend_ok"]:

123 sys.stderr.write(f"keychain: backend unavailable on {info['platform']}\n")

124 if info["remediation"]:

125 sys.stderr.write(f"keychain: {info['remediation']}\n")

126 sys.exit(2)

127 return info["platform"]

128

129

130def _decode_security_password(stderr: bytes) -> Optional[str]:

131 """Pull the secret out of `security ... -g` stderr and decode it.

132

Source & flagged code

13 flagged · loading source

pipeline/skills/shared/external/swift-security/references/common-anti-patterns.mdView file

87patternName = stripe_live_secret severity = critical line = 87

Critical

Critical Secret

Package contains a critical-looking secret pattern.

pipeline/skills/shared/external/swift-security/references/common-anti-patterns.mdView on unpkg · L87

87patternName = stripe_live_secret severity = critical line = 87

Critical

Secret Pattern

Stripe live secret key in pipeline/skills/shared/external/swift-security/references/common-anti-patterns.md

pipeline/skills/shared/external/swift-security/references/common-anti-patterns.mdView on unpkg · L87

pipeline/scripts/verify-citations.mjsView file

Findings

3 Critical5 High8 Medium5 Low

CriticalCritical Secretpipeline/skills/shared/external/swift-security/references/common-anti-patterns.md

CriticalTrojan Source Unicodepipeline/scripts/scenario-audit.mjs#virtual:normalized:round1

CriticalSecret Patternpipeline/skills/shared/external/swift-security/references/common-anti-patterns.md

HighChild Processpipeline/scripts/verify-citations.mjs

HighShell

HighSame File Env Network Executionpipeline/scripts/usage-register.mjs#virtual:normalized:round1

HighExternal Ai Agent Control Surface Mutationpipeline/scripts/localize-commands.mjs

HighSemantic Analysis Limitedinstall/_mcp-register.mjs#virtual:normalized:round1

MediumDynamic Requirepipeline/scripts/skill-conformance.mjs#virtual:normalized:round1

Affected versions and remediation

This report applies to @mmerterden/multi-agent-pipeline@20.16.0.

See all versions of @mmerterden/multi-agent-pipeline for other recorded verdicts.

Review the evidence and your use of @mmerterden/multi-agent-pipeline@20.16.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-12 00:36:02.305Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code