registry / @programinglive/dev-workflow-mcp-server / 1.18.1
@programinglive/dev-workflow-mcp-server@1.18.1
MCP server to enforce development workflow discipline
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe lifecycle hooks do not contact a collector or access credentials: postinstall only creates an absent workflow-state file, and prepare skips Husky setup outside a Git checkout. Configuration changes and the RTK download belong to separately invoked setup scripts and match the package's stated purpose.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
npm lifecycle hooks run during installation; broader OpenCode and project configuration changes require the user to run the setup command. The RTK bootstrap is a separate user-invoked shell script.
Impact
Expected setup effects are workflow-state creation and developer-tool configuration. No automatic credential collection, unrelated data transfer, or destructive action was identified.
Mechanism
postinstall initializes an absent workflow state file; prepare skips Husky outside a Git checkout. The setup command registers the MCP server and plugin and may add project guidance.
AI rationale
The lifecycle hooks do not contact a collector or access credentials: postinstall only creates an absent workflow-state file, and prepare skips Husky setup outside a Git checkout. Configuration changes and the RTK download belong to separately invoked setup scripts and match the package's stated purpose.
Evidence
INIT_CWD/.state/workflow-state.jsonOpenCode configDir/opencode.jsonOpenCode configDir/secrets/opencode-backup-<timestamp>.jsonINIT_CWD/AGENTS.md
Network endpoints3
raw.githubusercontent.com/rtk-ai/rtk/refs/heads/master/install.shgithub.com/obra/superpowers.gitopencode.ai/config.json
Decision evidence
public snapshotAI called this Clean at 90.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest declares prepare and postinstall hooks.
- postinstall skips execution from inside node_modules and creates an initial .state/workflow-state.json only when that file is absent.
- The prepare hook skips Husky setup when the package directory has no .git checkout.
- OpenCode configuration and AGENTS.md changes are performed by the separate setup script when directly run.
- The Unix bootstrap downloads RTK's installer from its named GitHub repository only when the user invokes the bootstrap and RTK is missing.
Evidence against
- postinstall does write workflow state into the directory where npm install was invoked.
- The explicit setup command can modify OpenCode configuration and add an AGENTS.md file to the target project.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
10 flaggedpackage.jsonView file
•scripts.postinstall = node install.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node install.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgexec.jsView file
1import { exec as execCallback, execFile as execFileCallback } from "child_process";
L2: import { existsSync } from "fs";
High
Findings
1 Critical6 High5 Medium6 Low
CriticalPrevious Version Dangerous Deltaworkflow-state.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processexec.js
HighShellscripts/install-husky.js
HighSandbox Evasion Gated Capabilityscripts/setup-stack.js
HighRuntime Package Installscripts/setup-stack.js
HighSemantic Analysis Limitedexec.js#virtual:normalized:round1
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperscripts/setup-test-dbs.sh
MediumStructural Risk Force Deep Review
Low
Affected versions and remediation
This report applies to @programinglive/dev-workflow-mcp-server@1.18.1.
See all versions of @programinglive/dev-workflow-mcp-server for other recorded verdicts.
- Review the evidence and your use of @programinglive/dev-workflow-mcp-server@1.18.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.