registry / @routerhub/agent-rules / 1.5.150
@routerhub/agent-rules@1.5.150
Shared Copilot agent rules and guidelines for RouterHub projects
Static Scan Results
scanned 2mo ago · by rust-scannerStatic analysis flagged 12 finding(s) at 97.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review; previous stored version diff introduced dangerous source
Decision evidence
public snapshotBehavioral surface
ChildProcessEnvironmentVarsFilesystem
HighEntropyStrings
Source & flagged code
7 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node postinstall.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node postinstall.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgmerge.jsView file
•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation.
output, copilotoutput]) {
writefileifchanged(outputpath, merged);
console.log(`✅ 规则已合并到 ${outputpath}`);
}
// 同步 skills
syncskills(config);
return;
}
// 2. 读取并解析私有规则的域标记
const privatecontent = readfileifexists(privaterulespath);
const privatedomains = parseprivatedomains(privatecontent);
// 3. 拼接全局规则内容
const globalcontent = globalrules
.map((rule) => rule.content.trim())
.join("\n\n");
// 4. 生成 .github/copilot-instructions.md（全局规则 + 私有全局部分）
let copilotcontent = "# copilot agent rules\n\n" + globalcontent;
if (privatedomains.global) {
copilotcontent += "\n\n---\n\n# 项目私有规则\n\n" + privatedomains.global;
}
writefilei
Findings
6 High3 Medium3 Low
HighInstall Time Lifecycle Scriptspackage.json
HighTrigger Reachable External Ai Agent Control Surface Mutationmerge.js
HighKnown Malware Source Similaritypostinstall.js
HighKnown Malware Source Similarityskills/screenshot-annotate/annotate.js
HighKnown Malware Source Fingerprint Signaturepostinstall.js
HighPrevious Version Dangerous Deltaskills/screenshot-annotate/annotate.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to @routerhub/agent-rules@1.5.150.
See all versions of @routerhub/agent-rules for other recorded verdicts.
- Review the evidence and your use of @routerhub/agent-rules@1.5.150 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.