@softure-ai/skills@0.11.0
SOFTURE agent skills: a spec-driven delivery workflow (shape → prd → roadmap → plan → implement → review) plus parallel worktree orchestration
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe postinstall hook does modify project agent configuration, but the README documents this as the package’s purpose and the installer limits changes to package-owned skills and managed blocks. The inspected code shows no credential transfer or malicious behavior.
Decision evidence
public snapshot- The manifest runs scripts/install.mjs as a postinstall hook.
- The installer targets the consuming project, copies this package’s skills, and writes a managed rules block and install manifest.
- The installer defaults to manual mode and skips existing skill folders it does not manage.
- The README documents the postinstall changes and says unmanaged skill folders are not overwritten.
- The uninstaller removes manifest-listed skills and strips the package’s managed blocks.
- The postinstall hook changes the project’s AI-agent setup without a separate installer command.
Source & flagged code
8 flagged · loading sourcePackage defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgThe manifest runs scripts/install.mjs as a postinstall hook.
package.jsonView on unpkg · L20Findings
Affected versions and remediation
This report applies to @softure-ai/skills@0.11.0.
See all versions of @softure-ai/skills for other recorded verdicts.
- Review the evidence and your use of @softure-ai/skills@0.11.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.