@softure-ai/skills@0.13.0
SOFTURE agent skills: a spec-driven delivery workflow (shape → prd → roadmap → plan → implement → review) plus parallel worktree orchestration
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe postinstall hook performs first-party agent setup by writing package-authored rules into a consumer control file. Its default rules require owner review, but the automatic behavior change leaves residual agent-extension lifecycle risk, so warn rather than block.
Decision evidence
public snapshot- The package postinstall hook runs the installer during npm installation.
- The installer writes selected package rules into the consumer project's root AGENTS.md or CLAUDE.md file.
- The supplied rules default to manual operation and require owner review at each step.
- The rules block is marked as package-managed, and a separate uninstaller removes manifest-listed installed files.
Source & flagged code
8 flagged · loading sourcePackage defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgThe package postinstall hook runs the installer during npm installation.
package.jsonView on unpkg · L23Findings
Affected versions and remediation
This report applies to @softure-ai/skills@0.13.0.
See all versions of @softure-ai/skills for other recorded verdicts.
- Review the evidence and your use of @softure-ai/skills@0.13.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.