@softure-ai/skills@0.9.0
SOFTURE agent skills: a spec-driven delivery workflow (shape → prd → roadmap → plan → implement → review) plus parallel worktree orchestration
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe postinstall hook mutates project agent configuration without an interactive prompt, leaving a concrete but package-aligned extension lifecycle risk. The inspected rules default to manual operation and the uninstaller removes managed additions, so a warning is appropriate rather than a publish block.
Decision evidence
public snapshot- The package runs scripts/install.mjs automatically in its postinstall hook.
- The installer targets project AGENTS.md or CLAUDE.md and writes a managed block of package rules there.
- The injected rules set workflow expectations for future agent sessions; the default mode is manual.
- The installer also copies package skills into the project's .claude/skills directory.
- The uninstaller removes recorded skills and strips managed blocks from project files.
- The integration is aligned with a package whose stated purpose is providing agent skills, and its configuration is marked as package-managed.
- The default rules require owner review and do not enable autonomous mode by default.
Source & flagged code
8 flagged · loading sourcePackage defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgThe package runs scripts/install.mjs automatically in its postinstall hook.
package.jsonView on unpkg · L19Findings
Affected versions and remediation
This report applies to @softure-ai/skills@0.9.0.
See all versions of @softure-ai/skills for other recorded verdicts.
- Review the evidence and your use of @softure-ai/skills@0.9.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.