@softure-ai/skills@0.5.2
SOFTURE agent skills: a spec-driven delivery workflow (shape → prd → roadmap → plan → implement → review) plus parallel worktree orchestration
AI Security Review
scanned 11d ago · by lpm-firewall-aiThe postinstall hook automatically installs this package’s own agent skills and managed instructions, creating an agent extension lifecycle risk. The inspected source supports a warning, but does not establish malicious behavior or a confirmed attack.
Decision evidence
public snapshot- The package runs scripts/install.mjs automatically through its postinstall hook.
- The installer targets a consumer project and selects AGENTS.md or CLAUDE.md for its rules block.
- The installer writes the selected rules into that file unless dry-run is enabled.
- The uninstall script uses a managed manifest and removes recorded skill directories and managed blocks.
- The installer copies this package’s own skills and rules; the inspected code shows no network endpoint or credential transfer.
- The installer skips existing skill folders it does not manage, and supports a dry-run option.
Source & flagged code
8 flagged · loading sourcePackage defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgThe package runs scripts/install.mjs automatically through its postinstall hook.
package.jsonView on unpkg · L22Findings
Affected versions and remediation
This report applies to @softure-ai/skills@0.5.2.
See all versions of @softure-ai/skills for other recorded verdicts.
- Review the evidence and your use of @softure-ai/skills@0.5.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.