@mmerterden/multi-agent-pipeline@20.27.0
6-phase AI development pipeline with full orchestration on Claude Code, Copilot CLI and Codex CLI. Analysis, planning, TDD, CLI-aware parallel review with consensus surfacing + Fable triage, default-FAIL evidence gates, secret + intent guards, per-phase c
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe package’s explicit Codex installer registers a first-party MCP extension whose version can change between host launches. This is a residual extension lifecycle risk, not evidence of an active attack.
Decision evidence
public snapshot- The Codex installer registers the publisher’s companion MCP package using an `@latest` specifier, so later host launches can resolve changing package code.
- Registration runs when the user invokes the package installer and selects Codex; the package manifest identifies the package and version.
- The flagged redaction and normalization operations perform text processing.
- The inspected source does not establish credential theft or another active attack.
Source & flagged code
26 flagged · loading sourcePackage contains a critical-looking secret pattern.
pipeline/skills/shared/external/swift-security/references/common-anti-patterns.mdView on unpkg · L87Stripe live secret key in pipeline/skills/shared/external/swift-security/references/common-anti-patterns.md
pipeline/skills/shared/external/swift-security/references/common-anti-patterns.mdView on unpkg · L87Findings
Affected versions and remediation
This report applies to @mmerterden/multi-agent-pipeline@20.27.0.
See all versions of @mmerterden/multi-agent-pipeline for other recorded verdicts.
- Review the evidence and your use of @mmerterden/multi-agent-pipeline@20.27.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.