registry / @mmerterden/multi-agent-pipeline / 20.5.0

@mmerterden/multi-agent-pipeline@20.5.0

⚠ Under review

6-phase AI development pipeline with full orchestration on Claude Code, Copilot CLI and Codex CLI. Analysis, planning, TDD, CLI-aware parallel review with consensus surfacing + Fable triage, default-FAIL evidence gates, secret + intent guards, per-phase c

Static Scan Results

scanned 27d ago · by rust-scanner

Static analysis completed at 72.0% confidence. No malicious behavior was detected; 18 low-signal pattern(s) were surfaced and cleared.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 162 file(s), 1.82 MB of source, external domains: 127.0.0.1, github.com, mmerterden.com, mmerterden.vercel.app, registry.npmjs.org

Source & flagged code

10 flagged

pipeline/scripts/keychain.pyView file

Lines 121-177python

121 info = doctor()

122 if not info["backend_ok"]:

123 sys.stderr.write(f"keychain: backend unavailable on {info['platform']}\n")

124 if info["remediation"]:

125 sys.stderr.write(f"keychain: {info['remediation']}\n")

126 sys.exit(2)

127 return info["platform"]

128

129

130def _decode_security_password(stderr: bytes) -> Optional[str]:

131 """Pull the secret out of `security ... -g` stderr and decode it.

132

133 `-w` cannot be used to read a secret this store may hold. It prints any value

134 containing a byte outside plain printable ASCII as BARE HEX with no marker,

135 which is indistinguishable from a secret that is itself hex - and 40-character

136 hex API tokens are exactly what lives here. Guessing from the shape would

137 corrupt them. `-g` marks the encoded form with an `0x` prefix, so the decision

138 is read off the output instead of inferred:

139

140 multi-line value -> password: 0x6C696E65310A6C696E6532 "line1\\012line2"

141 hex-looking value -> password: "deadbeefcafe1234"

Medium

Secret Pattern

Package contains a possible secret pattern.

pipeline/scripts/keychain.pyView on unpkg · L141

142

143 Two shapes, measured rather than assumed:

144 - `0x<HEX>` present -> the hex is authoritative; a quoted trailer may follow

145 or may be absent entirely (an all-non-ASCII value prints hex only).

146 - no `0x` -> the value sits between the first and last double quote. Inner

147 quotes are NOT escaped by `security` (`he"llo` prints as `"he"llo"`), so

148 first-to-last is the correct span and unescaping would be wrong.

149

150 The secret is parsed in-process and returned to the caller. It is never

151 logged, never placed in an exception message, and never passed as an argv

152 element.

153 """

154 for raw in stderr.split(b"\n"):

155 if not raw.startswith(b"password: "):

156 continue

157 body = raw[len(b"password: "):].rstrip(b"\r")

Medium

Secret Pattern

Hardcoded password in pipeline/scripts/keychain.py

pipeline/scripts/keychain.pyView on unpkg · L157

158 if body.startswith(b"0x"):

159 hex_digits = body[2:].split(b" ", 1)[0]

160 try:

161 return bytes.fromhex(hex_digits.decode("ascii")).decode("utf-8", errors="replace")

162 except ValueError:

163 return None

164 first = body.find(b'"')

165 last = body.rfind(b'"')

166 if first != -1 and last > first:

167 return body[first + 1:last].decode("utf-8", errors="replace")

168 return body.decode("utf-8", errors="replace")

169 return None

170

171

172def _macos_find(args: list[str]) -> Optional[str]:

173 """One `find-generic-password -g` lookup; None when the item is absent.

174

175 Trailing newlines are stripped, which is what the `-w` path did before and

176 what every consumer already assumes: a newline on the end of a token is an

177 artifact of pasting it, and it breaks an HTTP header the moment it survives.

pipeline/scripts/verify-citations.mjsView file

Lines 46-86javascript

46 * characters, or is the whole line. A line number with no quote only says

47 * the line exists; the quote says what the reviewer read on it;

48 * - every finding claimed pre-existing is checked against the base commit

49 * (_pre-existing.mjs);

pipeline/scripts/skill-conformance.mjs#virtual:normalized:round1View file

368// would be extracted into the manifest and injected into every reviewer L369: // prompt via the shared ${CRITERIA} block. Contain it to the skill"s own\n // directory; a declaration that escapes is recorded, not followed.\n const rulesPath = resolv... L370: // report a clean review over criteria it never loaded.

Medium

Dynamic Require

Package source references dynamic require/import behavior.

pipeline/scripts/skill-conformance.mjs#virtual:normalized:round1View on unpkg · L368

pipeline/scripts/build-stack-plugins.mjsView file

Lines 9-49javascript

9 * pipeline is the single authoring source; the marketplace is a derived, versioned

10 * publish artifact.

11 *

12 * The authored lifecycle skills (index / reference / workflow / tools) live in the

pipeline/scripts/autopilot-awake.mjsView file

Lines 2-42javascript

2/**

3 * autopilot-awake.mjs - the launchd job that keeps the Mac awake while

4 * autopilot is on.

5 *

6 * The schedule's StartInterval does not wake a sleeping Mac. The in-flight lock

7 * (`caffeinate -s -w <runner pid>`, _autopilot-ops.mjs) covers a run while it is

8 * going, and nothing covers the gap between ticks: the machine sleeps, the next

9 * tick never fires, and the queue stops with nothing to say so. This job closes

10 * that gap. It is a second, separate launchd agent that runs

pipeline/scripts/usage-register.mjs#virtual:normalized:round1View file

10* admin, no credential store: one status line, exit 0. L11: * - It never reports run CONTENT. That is usage-report.mjs"s contract, and it\n * is coarse metadata only.\n *\n * Usage:\n * node usage-register.mjs [--prefs <path>] [--json] ... L12: * name in `usageLog.trustedHosts`; http only to loopback (local development).

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

pipeline/scripts/usage-register.mjs#virtual:normalized:round1View on unpkg · L10

pipeline/scripts/localize-commands.mjsView file

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: eturn false; writefilesync(file, next); return true; } export function localizecommands(dir, mode) { if (!existssync(dir)) return 0; const files = []; const rootskill = join(dir, "skill.md"); if (existssync(rootskill)) files.push(rootskill); for (const entry of readdirsync(dir)) { const sub = join(dir, entry, "skill.md"); try { if (statsync(join(dir, entry)).isdirectory() && existssync(sub)) files.push(sub); } catch { } } let changed = 0; for (con

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

pipeline/scripts/localize-commands.mjsView on unpkg

pipeline/scripts/github-ssh-setup.shView file

•path = pipeline/scripts/github-ssh-setup.sh kind = build_helper sizeBytes = 10099 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

pipeline/scripts/github-ssh-setup.shView on unpkg

install/_mcp-register.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 21

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

install/_mcp-register.mjs#virtual:normalized:round1View on unpkg

Source & flagged code

10 flagged · loading source

pipeline/scripts/keychain.pyView file

141patternName = generic_password severity = medium line = 141

Medium

Secret Pattern

Package contains a possible secret pattern.

pipeline/scripts/keychain.pyView on unpkg · L141

157patternName = generic_password severity = medium line = 157

Medium

Secret Pattern

Hardcoded password in pipeline/scripts/keychain.py

pipeline/scripts/keychain.pyView on unpkg · L157

pipeline/scripts/verify-citations.mjsView file

66import { dirname, resolve as resolvePath, sep } from "node:path"; L67: import { spawnSync } from "node:child_process"; L68: import { runMain } from "../lib/fatal.mjs";

High

Child Process

Package source references child process execution.

Findings

5 High8 Medium5 Low

HighChild Processpipeline/scripts/verify-citations.mjs

HighShell

HighSame File Env Network Executionpipeline/scripts/usage-register.mjs#virtual:normalized:round1

HighExternal Ai Agent Control Surface Mutationpipeline/scripts/localize-commands.mjs

HighSemantic Analysis Limitedinstall/_mcp-register.mjs#virtual:normalized:round1

MediumSecret Patternpipeline/scripts/keychain.py

MediumDynamic Requirepipeline/scripts/skill-conformance.mjs#virtual:normalized:round1

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencepipeline/scripts/autopilot-awake.mjs

MediumShips Build Helperpipeline/scripts/github-ssh-setup.sh

Medium

Affected versions and remediation

This report applies to @mmerterden/multi-agent-pipeline@20.5.0.

See all versions of @mmerterden/multi-agent-pipeline for other recorded verdicts.

Review the evidence and your use of @mmerterden/multi-agent-pipeline@20.5.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-26 05:52:18.151Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.