registry / agentic-kdd / 3.9.5

agentic-kdd@3.9.5

Autonomous development pipeline — aa: · ag: · audit: · AST graph · Harness · Specs · Impact analysis · Decision trail · Metrics · MCP server. Works with Cursor and Claude Code.

Static Scan Results

scanned 3d ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 11 file(s), 403 KB of source, external domains: cdnjs.cloudflare.com, github.com, visualstudio.microsoft.com

Source & flagged code

4 flagged

bin/akdd.jsView file

Lines 1-33javascript

1#!/usr/bin/env node

2'use strict';

4const { init } = require('../src/init');

5const { update } = require('../src/update');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/akdd.jsView on unpkg · L3

6const { onboard } = require('../src/onboard');

7const { graph } = require('../src/graph');

8const { dashboard } = require('../src/dashboard');

9const { analyze } = require('../src/analyze');

10const { mcpSetup, mcpStatus } = require('../src/mcp-setup');

11const pkg = require('../package.json');

12const path = require('path');

13const fs = require('fs');

14const { execSync } = require('child_process');

High

Child Process

Package source references child process execution.

bin/akdd.jsView on unpkg · L13

16const args = process.argv.slice(2);

17const command = args[0];

18const arg1 = args[1];

19const arg2 = args[2];

21const HELP = `

22 Agentic KDD v${pkg.version}

23 Autonomous development pipeline — one developer, full-department output.

25 Setup:

26 akdd init Install Agentic KDD in the current project

27 akdd update Update agents + engine (memory stays intact)

28 akdd onboard Analyze existing project + pre-populate memory

29 akdd analyze Cross-artifact consistency check

30 akdd locks Lock Manager status

31 akdd locks release-all Release all locks for this instance

32 akdd hooks Install git hooks (registro automático de contratos)

33 akdd hooks status Show git hook status

src/init.jsView file

Lines 196-236javascript

196

197 // ── INSTALAR — crear carpetas PRIMERO antes de preguntar docs ──

198 const spinner = ora({ text: 'Descargando Agentic KDD...', color: 'magenta' }).start();

199 let sourcePath;

200 try {

201 sourcePath = await downloadFromGitHub

install.shView file

•path = install.sh kind = build_helper sizeBytes = 2899 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

Source & flagged code

4 flagged · loading source

bin/akdd.jsView file

13const fs = require('fs'); L14: const { execSync } = require('child_process'); L15:

High

Child Process

Package source references child process execution.

bin/akdd.jsView on unpkg · L13

3L4: const { init } = require('../src/init'); L5: const { update } = require('../src/update');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/akdd.jsView on unpkg · L3

src/init.jsView file

216try { L217: require('child_process').execSync('npm install better-sqlite3 --save', { L218: stdio: 'pipe', cwd: projectPath

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

src/init.jsView on unpkg · L216

install.shView file

•path = install.sh kind = build_helper sizeBytes = 2899 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

Findings

3 High5 Medium5 Low

HighChild Processbin/akdd.js

HighShell

HighRuntime Package Installsrc/init.js

MediumDynamic Requirebin/akdd.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperinstall.sh

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

bin/akdd.jsView file

Lines 1-33javascript

1#!/usr/bin/env node

2'use strict';

4const { init } = require('../src/init');

5const { update } = require('../src/update');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/akdd.jsView on unpkg · L3

6const { onboard } = require('../src/onboard');

7const { graph } = require('../src/graph');

8const { dashboard } = require('../src/dashboard');

9const { analyze } = require('../src/analyze');

10const { mcpSetup, mcpStatus } = require('../src/mcp-setup');

11const pkg = require('../package.json');

12const path = require('path');

13const fs = require('fs');

14const { execSync } = require('child_process');

High

Child Process

Package source references child process execution.

bin/akdd.jsView on unpkg · L13

16const args = process.argv.slice(2);

17const command = args[0];

18const arg1 = args[1];

19const arg2 = args[2];

21const HELP = `

22 Agentic KDD v${pkg.version}

23 Autonomous development pipeline — one developer, full-department output.

25 Setup:

26 akdd init Install Agentic KDD in the current project

27 akdd update Update agents + engine (memory stays intact)

28 akdd onboard Analyze existing project + pre-populate memory

29 akdd analyze Cross-artifact consistency check

30 akdd locks Lock Manager status

31 akdd locks release-all Release all locks for this instance

32 akdd hooks Install git hooks (registro automático de contratos)

33 akdd hooks status Show git hook status

src/init.jsView file

Lines 196-236javascript

196

197 // ── INSTALAR — crear carpetas PRIMERO antes de preguntar docs ──

198 const spinner = ora({ text: 'Descargando Agentic KDD...', color: 'magenta' }).start();

199 let sourcePath;

200 try {

201 sourcePath = await downloadFromGitHub

install.shView file

•path = install.sh kind = build_helper sizeBytes = 2899 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg