registry / @podosoft/podokit / 0.3.0

@podosoft/podokit@0.3.0

An opinionated but extensible starter toolkit and CLI for full-stack TypeScript apps with NestJS, SvelteKit, TailwindCSS, shadcn-svelte, Docker, and k3s.

AI Security Review

scanned 13d ago · by lpm-firewall-ai

No confirmed malicious attack surface was found. The package is a user-invoked project scaffolding CLI that writes bundled starter templates and optional modules into the current or requested project directory.

Static reason

No blocking static signals were detected.

Trigger

User runs podo create <name> or podo add <module>

Impact

Creates or modifies generated application files as requested by the CLI command; no install-time execution, exfiltration, remote payload loading, or AI-agent control-surface mutation found.

Mechanism

local template scaffolding and module overlay

Rationale

Static inspection shows a conventional scaffolding CLI with no lifecycle hooks and no import-time malicious behavior. File writes and network-related strings are package-aligned template generation, local dev endpoints, or user-invoked generated app functionality.

Evidence

package.jsondist/index.jsdist/create.jsdist/add.jsdist/templates.jsdist/prompt.jsdist/templates/modules/auth/module.manifest.jsondist/templates/modules/object-storage-s3/module.manifest.json<targetDir>/**apps/api/package.json.env.exampleapps/api/src/app.module.ts

Network endpoints6

localhost:3000

@podosoft/podokit@0.3.0

AI Security Review

Decision evidence

Source & flagged code

Findings