registry / @qatrolabs/qatro / 0.1.4

@qatrolabs/qatro@0.1.4

Qatrolabs engineering harness: scaffold and operate Spec-Driven-Development projects for AI coding tools

AI Security Review

scanned 9d ago · by lpm-firewall-ai

No confirmed malicious install-time or import-time attack surface. User-invoked commands scaffold project files, run local git/docker tooling, or explicitly launch an AI agent/Jira workflow.

Static reason

No blocking static signals were detected.

Trigger

Explicit qatro CLI commands such as new, upgrade, spec, sandbox, or jira push.

Impact

Writes harness files in the selected project; optional commands may invoke local git, Docker, Claude, or configured Atlassian MCP.

Mechanism

Project scaffolding and opt-in agent orchestration.

Rationale

Static source inspection shows a legitimate, user-invoked project scaffolding and AI-workflow CLI with no lifecycle execution or concrete malicious chain. The scanner’s test-payload hint is a benign Python unittest fixture.

Evidence

package.jsoncli/bin/qatro.jscli/src/lib/scaffold.jscli/src/lib/agentRunner.jscli/src/lib/sandbox.jscli/src/commands/jiraPushCmd.jstemplates/stacks/python-cli/tests/test_smoke.pyscripts/verify-state.shscripts/approve-spec.shadapters/claude-code/mcp.jsonadapters/cursor/mcp.json

Network endpoints1

mcp.atlassian.com/v1/sse

@qatrolabs/qatro@0.1.4

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code