@softure-ai/skills@0.12.0
SOFTURE agent skills: a spec-driven delivery workflow (shape → prd → roadmap → plan → implement → review) plus parallel worktree orchestration
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe postinstall hook automatically installs this package’s own agent skills and rules into the consumer project, so this warrants a warning for first-party agent extension setup. The inspected behavior is scoped and managed, with no concrete attack established.
Decision evidence
public snapshot- package.json runs scripts/install.mjs automatically from postinstall.
- The installer copies package skills into the consumer project’s .claude/skills directory and writes package-owned rules into AGENTS.md or CLAUDE.md.
- The installer records its installed files in a project manifest; the separate uninstall command removes managed content.
- Inspected installer behavior is limited to installing the package’s own skills, managed rules, and bookkeeping; the cited paths show no credential transfer or remote payload execution.
Source & flagged code
8 flagged · loading sourcePackage defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgpackage.json runs scripts/install.mjs automatically from postinstall.
package.jsonView on unpkg · L22Findings
Affected versions and remediation
This report applies to @softure-ai/skills@0.12.0.
See all versions of @softure-ai/skills for other recorded verdicts.
- Review the evidence and your use of @softure-ai/skills@0.12.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.