agentic-qe@3.11.3: Suspicious npm security report (Warn)

Loading npm security reports…

agentic-qe@3.11.3: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

42 flagged

package.jsonView file

Lines 40-81json

40 "./routing/free-tier": {

41 "import": "./dist/routing/free-tier/index.js",

42 "types": "./dist/routing/free-tier/index.d.ts"

43 },

44 "./routing/value-score": {

45 "import": "./dist/routing/value-score.js",

46 "types": "./dist/routing/value-score.d.ts"

47 },

48 "./verification/adversarial-verify": {

49 "import": "./dist/verification/adversarial-verify/index.js",

50 "types": "./dist/verification/adversarial-verify/index.d.ts"

51 }

52 },

53 "bin": {

54 "agentic-qe": "./dist/cli/bundle.js",

55 "aqe": "./dist/cli/bundle.js",

56 "aqe-v3": "./dist/cli/bundle.js",

57 "aqe-mcp": "./dist/mcp/bundle.js"

58 },

59 "scripts": {

60 "preinstall": "node scripts/preinstall.cjs || true",

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L60

61 "postinstall": "node scripts/postinstall.cjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L61

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L61

62 "build": "tsc && npm run build:cli && npm run build:mcp",

63 "build:cli": "node scripts/build-cli.mjs",

64 "build:mcp": "node scripts/build-mcp.mjs",

65 "prepublishOnly": "node scripts/sync-agents.cjs && node scripts/prepare-assets.cjs",

66 "cli": "tsx src/cli/index.ts",

67 "aqe": "tsx src/cli/index.ts",

68 "mcp": "tsx src/mcp/entry.ts",

69 "test": "NODE_OPTIONS='--max-old-space-size=1024 --expose-gc' vitest run",

70 "test:unit": "npm run test:unit:fast && npm run test:unit:heavy && npm run test:unit:mcp",

71 "test:unit:fast": "vitest run --exclude='**/qe-reasoning-bank.test.ts' --exclude='**/qe-reasoning-bank-feedback-loop.test.ts' --exclude='**/aqe-learning-engine.test.ts' --exclude='**/aqe-learning-engine-patterns.test.ts' tests/unit/adapters tests/unit/shared tests/unit/cli tests/unit/learning tests/unit/kernel tests/unit/workers tests/unit/routing tests/unit/strange-loop tests/unit/sync tests/unit/feedback tests/unit/error-paths tests/unit/early-exit tests/unit/causal-discovery tests/unit/neural-optimizer tests/unit/test-scheduling tests/unit/logging tests/unit/validation tests/unit/memory ...

72 "test:unit:heavy": "vitest run tests/unit/coordination tests/unit/domains tests/unit/integrations tests/unit/optimization tests/unit/init --exclude='**/browser/**' --exclude='**/*.e2e.test.ts' --exclude='**/vibium/**' --exclude='**/browser-swarm-coordinator.test.ts'",

73 "test:unit:mcp": "vitest run tests/unit/mcp --exclude='**/mcp/handlers/domain-handlers.test.ts' --fileParallelism=false",

74 "test:ci": "vitest run --exclude='**/browser/**' --exclude='**/*.e2e.test.ts' --exclude='**/vibium/**' --exclude='**/integration/browser/**' --exclude='**/browser-swarm-coordinator.test.ts' --exclude='**/mcp/handlers/domain-handlers.test.ts'",

75 "test:e2e": "vitest run tests/integration/browser --testTimeout=120000",

76 "test:safe": "NODE_OPTIONS='--max-old-space-size=768 --expose-gc' vitest run --maxForks=1",

77 "test:dev": "npm run test:unit:fast",

78 "test:all": "npm test -- --run",

79 "test:mcp": "npm run test:unit:mcp",

80 "test:mcp:integration": "npm test -- --run tests/integration/mcp/",

81 "test:integration:fast": "NODE_OPTIONS='--max-old-space-size=2048 --expose-gc' vitest run tests/integration/mcp/fleet-init-wires-daemon.test.ts tests/integration/mcp/mcp-cli-inprocess.test.ts tests/integration/mcp/memory-delete-cache-invalidation.test.ts tests/integration/workers/workers-reach-domains.test.ts tests/integration/learning/coordinator-roundtrip.test.ts tests/integration/bridge/bridge-end-to-end.test.ts",

Long lines were clipped for display.

.claude/agents/v3/subagents/qe-security-reviewer.mdView file

Lines 256-296markdown

256 const DB_PASSWORD = 'super_secret_password_123';

257 ```

258 - Type: Database credential

259 - Entropy: 3.2 (medium)

260 - Action: Rotate password

261 - Remediation: Use secrets manager

262

2633. **JWT Secret** (HIGH)

264 ```

265 // auth.ts:15

266 const JWT_SECRET = 'my-jwt-secret-key-very-long';

dist/init/enhancements/claude-flow-adapter.jsView file

Lines 90-130javascript

90 transfer: false,

91 };

92 }

93 // All features available when Claude Flow is present

94 return {

95 trajectories: true,

96 modelRouting: true,

dist/integrations/browser/web-content-fetcher.jsView file

Lines 1-41javascript

1/**

2 * Web Content Fetcher - V3 Browser Cascade

3 *

4 * Provides resilient web content fetching with a 5-tier cascade:

5 * 1. Vibium MCP Browser (best for bot-protected sites)

6 * 2. Agent Browser (CLI-based with refs)

7 * 3. Playwright + Stealth (headless with anti-detection)

8 * 4. Simple HTTP Fetch (for static sites)

9 * 5. Web Search Fallback (research-based, last resort)

10 *

dist/domains/security-compliance/services/security-auditor-sast.jsView file

Lines 31-71javascript

31 title: 'XSS via innerHTML Assignment',

32 description: 'Direct innerHTML assignment with potentially unsanitized content',

33 severity: 'high',

34 category: 'xss',

dist/init/phases/07-hooks.jsView file

Lines 174-214javascript

174 installHookAssets(hooksDir, context) {

175 const { projectRoot } = context;

176 // Install brain-checkpoint helper into .claude/helpers/

177 this.installBrainCheckpoint(projectRoot, context);

178 // Install statusline-v3 helper into .claude/helpers/

179

dist/cli/chunks/chunk-UFZCHVLH.jsView file

1import{createRequire as __cr}from"module";const require=__cr(import.meta.url);if(process.argv.includes('--version')||process.argv.includes('-v')){console.log("3.11.3");process.exit... L2: var N="ffffffff-ffff-ffff-ffff-ffffffffffff";var _="00000000-0000-0000-0000-000000000000";var y=/^(?:[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}|0000000...

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/cli/chunks/chunk-UFZCHVLH.jsView on unpkg · L1

dist/cli/chunks/completions-VRFFK223.jsView file

1import{createRequire as __cr}from"module";const require=__cr(import.meta.url);if(process.argv.includes('--version')||process.argv.includes('-v')){console.log("3.11.3");process.exit... L2: import"./chunk-PUK5NE47.js";import{Command as v}from"commander";import o from"chalk";var c=["test-generation","test-execution","coverage-analysis","quality-assessment","defect-inte... L3: # AQE CLI Bash Completion Script ... L55: local protocol_subcmds="run" L56: local completions_subcmds="bash zsh fish powershell install" L57: local brain_subcmds="export import info diff search witness-backfill" ... L1410: } L1411: `}function $(){let t=process.env.SHELL||"";if(process.env.PSVersionTable||process.env.PSModulePath)return{name:"powershell",configFile:process.platform==="win32"?`${process.env.USE... L1412: eval "$(aqe completions bash)"

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/cli/chunks/completions-VRFFK223.jsView on unpkg · L1

dist/cli/chunks/chunk-6WWNK67C.jsView file

105L106: Focus on accuracy over speed. It's better to mark something as "INCONCLUSIVE" if you're unsure than to give an incorrect assessment.`}isNonRetryableError(t){if(!(t instanceof Error... L107: Your task is to verify security findings with high accuracy. ... L113: Always explain your reasoning clearly. L114: Format your response with: verdict (confirmed/rejected/uncertain), confidence (0-100), and reasoning.`}}});import{randomUUID as vp}from"crypto";_a();var Ya={LOOP_WARNING:"loop.warn... L115: This usually means the domain is not enabled in your config.

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli/chunks/chunk-6WWNK67C.jsView on unpkg · L105

dist/cli/chunks/chunk-ZDPQB67L.jsView file

1import{createRequire as __cr}from"module";const require=__cr(import.meta.url);if(process.argv.includes('--version')||process.argv.includes('-v')){console.log("3.11.3");process.exit... L2: var P="quality-daemon",x=class{constructor(e){this.backend=e}backend;async get(e){return this.backend.kvGet(e,P)}async set(e,t){await this.backend.kvSet(e,t,P)}async search(e){retu... L3: `)){if(!i)continue;let[o,r]=i.split(" "),n=this.lastKnownHeads.get(o);n&&n!==r&&(e.push(o),await this.enqueueCommitAnalysis(o,r)),this.lastKnownHeads.set(o,r)}}catch{}finally{this.... L4: `).filter(Boolean).slice(0,this.options.maxChangedFiles)}catch{}let o={type:"git_commit",branch:e,commitHash:t,changedFiles:i},r={id:`git-${t}-${Date.now()}`,priority:"next",payloa... L5: `)){if(!t)continue;let[i,o]=t.split(" ");this.lastKnownHeads.set(i,o)}}catch{}}};var E={regressionThreshold:2,gapThreshold:60,memoryPrefix:"quality-daemon:coverage"},f=class{constr...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/cli/chunks/chunk-ZDPQB67L.jsView on unpkg · L1

assets/grammars/tree-sitter-python.wasmView file

•path = assets/grammars/tree-sitter-python.wasm kind = wasm_module sizeBytes = 460119 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

assets/grammars/tree-sitter-python.wasmView on unpkg

.claude/hooks/post-task-sync.shView file

•path = .claude/hooks/post-task-sync.sh kind = payload_in_excluded_dir sizeBytes = 3251 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.claude/hooks/post-task-sync.shView on unpkg

•path = .claude/hooks/post-task-sync.sh kind = build_helper sizeBytes = 3251 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

.claude/hooks/post-task-sync.shView on unpkg

dist/mcp/bundle.jsView file

•path = dist/mcp/bundle.js kind = oversized_source_file sizeBytes = 3750944 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/mcp/bundle.jsView on unpkg

•path = dist/mcp/bundle.js kind = oversized_cli_entrypoint sizeBytes = 3750944 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/mcp/bundle.jsView on unpkg

.claude/agents/core/reviewer.mdView file

151patternName = generic_password severity = medium line = 151 matchedText = console....rd);

Medium

Secret Pattern

Hardcoded password in .claude/agents/core/reviewer.md

.claude/agents/core/reviewer.mdView on unpkg · L151

.claude/agents/flow-nexus/authentication.mdView file

22patternName = generic_password severity = medium line = 22 matchedText = password...rd",

Medium

Secret Pattern

Hardcoded password in .claude/agents/flow-nexus/authentication.md

.claude/agents/flow-nexus/authentication.mdView on unpkg · L22

29patternName = generic_password severity = medium line = 29 matchedText = passwo...

Medium

Secret Pattern

Hardcoded password in .claude/agents/flow-nexus/authentication.md

.claude/agents/flow-nexus/authentication.mdView on unpkg · L29

43patternName = generic_password severity = medium line = 43 matchedText = new_pass...ord"

Medium

Secret Pattern

Hardcoded password in .claude/agents/flow-nexus/authentication.md

.claude/agents/flow-nexus/authentication.mdView on unpkg · L43

.claude/agents/v3/subagents/qe-tdd-red.mdView file

159patternName = generic_password severity = medium line = 159 matchedText = password...123'

Medium

Secret Pattern

Hardcoded password in .claude/agents/v3/subagents/qe-tdd-red.md

.claude/agents/v3/subagents/qe-tdd-red.mdView on unpkg · L159

171patternName = generic_password severity = medium line = 171 matchedText = const cr...' };

Medium

Secret Pattern

Hardcoded password in .claude/agents/v3/subagents/qe-tdd-red.md

.claude/agents/v3/subagents/qe-tdd-red.mdView on unpkg · L171

183patternName = generic_password severity = medium line = 183 matchedText = const cr...' };

Medium

Secret Pattern

Hardcoded password in .claude/agents/v3/subagents/qe-tdd-red.md

.claude/agents/v3/subagents/qe-tdd-red.mdView on unpkg · L183

249patternName = generic_password severity = medium line = 249 matchedText = const pa...23';

Medium

Secret Pattern

Hardcoded password in .claude/agents/v3/subagents/qe-tdd-red.md

.claude/agents/v3/qe-pentest-validator.mdView file

295patternName = generic_password severity = medium line = 295 matchedText = - passwo...tial

Medium

Secret Pattern

Hardcoded password in .claude/agents/v3/qe-pentest-validator.md

.claude/agents/v3/qe-pentest-validator.mdView on unpkg · L295

.claude/agents/sparc/refinement.mdView file

339patternName = generic_password severity = medium line = 339 matchedText = password...23!'

Medium

Secret Pattern

Hardcoded password in .claude/agents/sparc/refinement.md

.claude/agents/sparc/refinement.mdView on unpkg · L339

367patternName = generic_password severity = medium line = 367 matchedText = password...ord'

Medium

Secret Pattern

Hardcoded password in .claude/agents/sparc/refinement.md

.claude/agents/sparc/refinement.mdView on unpkg · L367

543patternName = generic_password severity = medium line = 543 matchedText = passwo...

Medium

Secret Pattern

Hardcoded password in .claude/agents/sparc/refinement.md

.claude/agents/sparc/refinement.mdView on unpkg · L543

.claude/skills/testability-scoring/resources/templates/config.template.jsView file

42patternName = generic_password severity = medium line = 42 matchedText = { userna...' },

Medium

Secret Pattern

Hardcoded password in .claude/skills/testability-scoring/resources/templates/config.template.js

.claude/skills/testability-scoring/resources/templates/config.template.jsView on unpkg · L42

43patternName = generic_password severity = medium line = 43 matchedText = { userna...' },

Medium

Secret Pattern

Hardcoded password in .claude/skills/testability-scoring/resources/templates/config.template.js

.claude/skills/testability-scoring/resources/templates/config.template.jsView on unpkg · L43

44patternName = generic_password severity = medium line = 44 matchedText = { userna...' },

Medium

Secret Pattern

Hardcoded password in .claude/skills/testability-scoring/resources/templates/config.template.js

.claude/skills/testability-scoring/resources/templates/config.template.jsView on unpkg · L44

.claude/skills/security-testing/SKILL.mdView file

128patternName = generic_password severity = medium line = 128 matchedText = await db... });

Medium

Secret Pattern

Hardcoded password in .claude/skills/security-testing/SKILL.md

.claude/skills/security-testing/SKILL.mdView on unpkg · L128

.claude/skills/n8n-security-testing/evals/n8n-security-testing.yamlView file

152patternName = generic_password severity = medium line = 152 matchedText = password...123"

Medium

Secret Pattern

Hardcoded password in .claude/skills/n8n-security-testing/evals/n8n-security-testing.yaml

.claude/skills/n8n-security-testing/evals/n8n-security-testing.yamlView on unpkg · L152

157patternName = generic_password severity = medium line = 157 matchedText = password...456"

Medium

Secret Pattern

Hardcoded password in .claude/skills/n8n-security-testing/evals/n8n-security-testing.yaml

.claude/skills/n8n-security-testing/evals/n8n-security-testing.yamlView on unpkg · L157

.claude/skills/flow-nexus-platform/SKILL.mdView file

33patternName = generic_password severity = medium line = 33 matchedText = password...rd",

Medium

Secret Pattern

Hardcoded password in .claude/skills/flow-nexus-platform/SKILL.md

.claude/skills/flow-nexus-platform/SKILL.mdView on unpkg · L33

43patternName = generic_password severity = medium line = 43 matchedText = password...ord"

Medium

Secret Pattern

Hardcoded password in .claude/skills/flow-nexus-platform/SKILL.md

.claude/skills/flow-nexus-platform/SKILL.mdView on unpkg · L43

Source & flagged code

42 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.preinstall = node scripts/preinstall.cjs || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.cjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

.claude/agents/v3/subagents/qe-security-reviewer.mdView file

276patternName = aws_access_key severity = critical line = 276 matchedText = export A...MPLE

Critical

Critical Secret

Package contains a critical-looking secret pattern.

.claude/agents/v3/subagents/qe-security-reviewer.mdView on unpkg · L276

276patternName = aws_access_key severity = critical line = 276 matchedText = export A...MPLE

Critical

Secret Pattern

AWS access key ID in .claude/agents/v3/subagents/qe-security-reviewer.md

.claude/agents/v3/subagents/qe-security-reviewer.mdView on unpkg · L276

dist/init/enhancements/claude-flow-adapter.jsView file

110try { L111: const { execFileSync } = await import('child_process'); L112: const { bin, args } = cfCliArgs('hooks', 'intelligence', 'trajectory-start', '--task', task);

High

Child Process

Package source references child process execution.

dist/init/enhancements/claude-flow-adapter.jsView on unpkg · L110

dist/integrations/browser/web-content-fetcher.jsView file

21import { safeJsonParse } from '../../shared/safe-json.js'; L22: const execAsync = promisify(exec); L23: // ============================================================================

High

Shell

Package source references shell execution.

dist/integrations/browser/web-content-fetcher.jsView on unpkg · L21

dist/domains/security-compliance/services/security-auditor-sast.jsView file

51pattern: /(?<!\.)\beval\s*$[^)]+$/g, L52: title: 'Code Injection via eval()', L53: description: 'eval() executes arbitrary code and is a major security risk',

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/domains/security-compliance/services/security-auditor-sast.jsView on unpkg · L51

dist/init/phases/07-hooks.jsView file

341* Agentic QE v3 Statusline (minimal fallback, generated by aqe init) L342: * For the full statusline, reinstall: npx agentic-qe init --auto L343: */ ... L345: const path = require('path'); L346: const { execFileSync } = require('child_process'); L347:

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/init/phases/07-hooks.jsView on unpkg · L341

194if (existsSync(src)) { L195: const { copyFileSync } = require('fs'); L196: copyFileSync(src, crossPhasePath);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/init/phases/07-hooks.jsView on unpkg · L194

dist/cli/chunks/chunk-UFZCHVLH.jsView file

1import{createRequire as __cr}from"module";const require=__cr(import.meta.url);if(process.argv.includes('--version')||process.argv.includes('-v')){console.log("3.11.3");process.exit... L2: var N="ffffffff-ffff-ffff-ffff-ffffffffffff";var _="00000000-0000-0000-0000-000000000000";var y=/^(?:[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}|0000000...

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/cli/chunks/chunk-UFZCHVLH.jsView on unpkg · L1

dist/cli/chunks/completions-VRFFK223.jsView file

1import{createRequire as __cr}from"module";const require=__cr(import.meta.url);if(process.argv.includes('--version')||process.argv.includes('-v')){console.log("3.11.3");process.exit... L2: import"./chunk-PUK5NE47.js";import{Command as v}from"commander";import o from"chalk";var c=["test-generation","test-execution","coverage-analysis","quality-assessment","defect-inte... L3: # AQE CLI Bash Completion Script ... L55: local protocol_subcmds="run" L56: local completions_subcmds="bash zsh fish powershell install" L57: local brain_subcmds="export import info diff search witness-backfill" ... L1410: } L1411: `}function $(){let t=process.env.SHELL||"";if(process.env.PSVersionTable||process.env.PSModulePath)return{name:"powershell",configFile:process.platform==="win32"?`${process.env.USE... L1412: eval "$(aqe completions bash)"

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/cli/chunks/completions-VRFFK223.jsView on unpkg · L1

dist/cli/chunks/chunk-6WWNK67C.jsView file

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli/chunks/chunk-6WWNK67C.jsView on unpkg · L105

dist/cli/chunks/chunk-ZDPQB67L.jsView file

1import{createRequire as __cr}from"module";const require=__cr(import.meta.url);if(process.argv.includes('--version')||process.argv.includes('-v')){console.log("3.11.3");process.exit... L2: var P="quality-daemon",x=class{constructor(e){this.backend=e}backend;async get(e){return this.backend.kvGet(e,P)}async set(e,t){await this.backend.kvSet(e,t,P)}async search(e){retu... L3: `)){if(!i)continue;let[o,r]=i.split(" "),n=this.lastKnownHeads.get(o);n&&n!==r&&(e.push(o),await this.enqueueCommitAnalysis(o,r)),this.lastKnownHeads.set(o,r)}}catch{}finally{this.... L4: `).filter(Boolean).slice(0,this.options.maxChangedFiles)}catch{}let o={type:"git_commit",branch:e,commitHash:t,changedFiles:i},r={id:`git-${t}-${Date.now()}`,priority:"next",payloa... L5: `)){if(!t)continue;let[i,o]=t.split(" ");this.lastKnownHeads.set(i,o)}}catch{}}};var E={regressionThreshold:2,gapThreshold:60,memoryPrefix:"quality-daemon:coverage"},f=class{constr...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/cli/chunks/chunk-ZDPQB67L.jsView on unpkg · L1

assets/grammars/tree-sitter-python.wasmView file

•path = assets/grammars/tree-sitter-python.wasm kind = wasm_module sizeBytes = 460119 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

assets/grammars/tree-sitter-python.wasmView on unpkg

.claude/hooks/post-task-sync.shView file

•path = .claude/hooks/post-task-sync.sh kind = payload_in_excluded_dir sizeBytes = 3251 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.claude/hooks/post-task-sync.shView on unpkg

•path = .claude/hooks/post-task-sync.sh kind = build_helper sizeBytes = 3251 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

.claude/hooks/post-task-sync.shView on unpkg

dist/mcp/bundle.jsView file

•path = dist/mcp/bundle.js kind = oversized_source_file sizeBytes = 3750944 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/mcp/bundle.jsView on unpkg

•path = dist/mcp/bundle.js kind = oversized_cli_entrypoint sizeBytes = 3750944 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/mcp/bundle.jsView on unpkg

.claude/agents/core/reviewer.mdView file

151patternName = generic_password severity = medium line = 151 matchedText = console....rd);

Medium

Secret Pattern

Hardcoded password in .claude/agents/core/reviewer.md

.claude/agents/core/reviewer.mdView on unpkg · L151

.claude/agents/flow-nexus/authentication.mdView file

22patternName = generic_password severity = medium line = 22 matchedText = password...rd",

Medium

Secret Pattern

Hardcoded password in .claude/agents/flow-nexus/authentication.md

.claude/agents/flow-nexus/authentication.mdView on unpkg · L22

29patternName = generic_password severity = medium line = 29 matchedText = passwo...

Medium

Secret Pattern

Hardcoded password in .claude/agents/flow-nexus/authentication.md

.claude/agents/flow-nexus/authentication.mdView on unpkg · L29

43patternName = generic_password severity = medium line = 43 matchedText = new_pass...ord"

Medium

Secret Pattern

Hardcoded password in .claude/agents/flow-nexus/authentication.md

.claude/agents/flow-nexus/authentication.mdView on unpkg · L43

.claude/agents/v3/subagents/qe-tdd-red.mdView file

159patternName = generic_password severity = medium line = 159 matchedText = password...123'

Medium

Secret Pattern

Hardcoded password in .claude/agents/v3/subagents/qe-tdd-red.md

.claude/agents/v3/subagents/qe-tdd-red.mdView on unpkg · L159

171patternName = generic_password severity = medium line = 171 matchedText = const cr...' };

Medium

Secret Pattern

Hardcoded password in .claude/agents/v3/subagents/qe-tdd-red.md

.claude/agents/v3/subagents/qe-tdd-red.mdView on unpkg · L171

183patternName = generic_password severity = medium line = 183 matchedText = const cr...' };

Medium

Secret Pattern

Hardcoded password in .claude/agents/v3/subagents/qe-tdd-red.md

.claude/agents/v3/subagents/qe-tdd-red.mdView on unpkg · L183

249patternName = generic_password severity = medium line = 249 matchedText = const pa...23';

Medium

Secret Pattern

Hardcoded password in .claude/agents/v3/subagents/qe-tdd-red.md

.claude/agents/v3/qe-pentest-validator.mdView file

295patternName = generic_password severity = medium line = 295 matchedText = - passwo...tial

Medium

Secret Pattern

Hardcoded password in .claude/agents/v3/qe-pentest-validator.md

.claude/agents/v3/qe-pentest-validator.mdView on unpkg · L295

.claude/agents/sparc/refinement.mdView file

339patternName = generic_password severity = medium line = 339 matchedText = password...23!'

Medium

Secret Pattern

Hardcoded password in .claude/agents/sparc/refinement.md

.claude/agents/sparc/refinement.mdView on unpkg · L339

367patternName = generic_password severity = medium line = 367 matchedText = password...ord'

Medium

Secret Pattern

Hardcoded password in .claude/agents/sparc/refinement.md

.claude/agents/sparc/refinement.mdView on unpkg · L367

543patternName = generic_password severity = medium line = 543 matchedText = passwo...

Medium

Secret Pattern

Hardcoded password in .claude/agents/sparc/refinement.md

.claude/agents/sparc/refinement.mdView on unpkg · L543

.claude/skills/testability-scoring/resources/templates/config.template.jsView file

42patternName = generic_password severity = medium line = 42 matchedText = { userna...' },

Medium

Secret Pattern

Hardcoded password in .claude/skills/testability-scoring/resources/templates/config.template.js

.claude/skills/testability-scoring/resources/templates/config.template.jsView on unpkg · L42

43patternName = generic_password severity = medium line = 43 matchedText = { userna...' },

Medium

Secret Pattern

Hardcoded password in .claude/skills/testability-scoring/resources/templates/config.template.js

.claude/skills/testability-scoring/resources/templates/config.template.jsView on unpkg · L43

44patternName = generic_password severity = medium line = 44 matchedText = { userna...' },

Medium

Secret Pattern

Hardcoded password in .claude/skills/testability-scoring/resources/templates/config.template.js

.claude/skills/testability-scoring/resources/templates/config.template.jsView on unpkg · L44

.claude/skills/security-testing/SKILL.mdView file

128patternName = generic_password severity = medium line = 128 matchedText = await db... });

Medium

Secret Pattern

Hardcoded password in .claude/skills/security-testing/SKILL.md

.claude/skills/security-testing/SKILL.mdView on unpkg · L128

.claude/skills/n8n-security-testing/evals/n8n-security-testing.yamlView file

152patternName = generic_password severity = medium line = 152 matchedText = password...123"

Medium

Secret Pattern

Hardcoded password in .claude/skills/n8n-security-testing/evals/n8n-security-testing.yaml

.claude/skills/n8n-security-testing/evals/n8n-security-testing.yamlView on unpkg · L152

157patternName = generic_password severity = medium line = 157 matchedText = password...456"

Medium

Secret Pattern

Hardcoded password in .claude/skills/n8n-security-testing/evals/n8n-security-testing.yaml

.claude/skills/n8n-security-testing/evals/n8n-security-testing.yamlView on unpkg · L157

.claude/skills/flow-nexus-platform/SKILL.mdView file

33patternName = generic_password severity = medium line = 33 matchedText = password...rd",

Medium

Secret Pattern

Hardcoded password in .claude/skills/flow-nexus-platform/SKILL.md

.claude/skills/flow-nexus-platform/SKILL.mdView on unpkg · L33

43patternName = generic_password severity = medium line = 43 matchedText = password...ord"

Medium

Secret Pattern

Hardcoded password in .claude/skills/flow-nexus-platform/SKILL.md

.claude/skills/flow-nexus-platform/SKILL.mdView on unpkg · L43

Findings

2 Critical8 High33 Medium7 Low

CriticalCritical Secret.claude/agents/v3/subagents/qe-security-reviewer.md

CriticalSecret Pattern.claude/agents/v3/subagents/qe-security-reviewer.md

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/init/enhancements/claude-flow-adapter.js

HighShelldist/integrations/browser/web-content-fetcher.js

HighSame File Env Network Executiondist/cli/chunks/chunk-6WWNK67C.js

HighCommand Output Exfiltrationdist/cli/chunks/chunk-ZDPQB67L.js

HighRuntime Package Installdist/init/phases/07-hooks.js

HighPayload In Excluded Dir.claude/hooks/post-task-sync.sh

HighOversized Source Filedist/mcp/bundle.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requiredist/init/phases/07-hooks.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/cli/chunks/completions-VRFFK223.js

MediumShips Wasm Moduleassets/grammars/tree-sitter-python.wasm

MediumShips Build Helper.claude/hooks/post-task-sync.sh

MediumOversized Cli Entrypointdist/mcp/bundle.js

MediumStructural Risk Force Deep Review

MediumSecret Pattern.claude/agents/core/reviewer.md

MediumSecret Pattern.claude/agents/flow-nexus/authentication.md

MediumSecret Pattern.claude/agents/v3/subagents/qe-tdd-red.md

MediumSecret Pattern.claude/agents/v3/qe-pentest-validator.md

MediumSecret Pattern.claude/agents/sparc/refinement.md

MediumSecret Pattern.claude/skills/testability-scoring/resources/templates/config.template.js

MediumSecret Pattern.claude/skills/security-testing/SKILL.md

MediumSecret Pattern.claude/skills/n8n-security-testing/evals/n8n-security-testing.yaml

MediumSecret Pattern.claude/skills/flow-nexus-platform/SKILL.md

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvaldist/domains/security-compliance/services/security-auditor-sast.js

LowWeak Cryptodist/cli/chunks/chunk-UFZCHVLH.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

42 flagged

package.jsonView file

Lines 40-81json

40 "./routing/free-tier": {

41 "import": "./dist/routing/free-tier/index.js",

42 "types": "./dist/routing/free-tier/index.d.ts"

43 },

44 "./routing/value-score": {

45 "import": "./dist/routing/value-score.js",

46 "types": "./dist/routing/value-score.d.ts"

47 },

48 "./verification/adversarial-verify": {

49 "import": "./dist/verification/adversarial-verify/index.js",

50 "types": "./dist/verification/adversarial-verify/index.d.ts"

51 }

52 },

53 "bin": {

54 "agentic-qe": "./dist/cli/bundle.js",

55 "aqe": "./dist/cli/bundle.js",

56 "aqe-v3": "./dist/cli/bundle.js",

57 "aqe-mcp": "./dist/mcp/bundle.js"

58 },

59 "scripts": {

60 "preinstall": "node scripts/preinstall.cjs || true",

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L60

61 "postinstall": "node scripts/postinstall.cjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L61

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L61

62 "build": "tsc && npm run build:cli && npm run build:mcp",

63 "build:cli": "node scripts/build-cli.mjs",

64 "build:mcp": "node scripts/build-mcp.mjs",

65 "prepublishOnly": "node scripts/sync-agents.cjs && node scripts/prepare-assets.cjs",

66 "cli": "tsx src/cli/index.ts",

67 "aqe": "tsx src/cli/index.ts",

68 "mcp": "tsx src/mcp/entry.ts",

69 "test": "NODE_OPTIONS='--max-old-space-size=1024 --expose-gc' vitest run",

70 "test:unit": "npm run test:unit:fast && npm run test:unit:heavy && npm run test:unit:mcp",

73 "test:unit:mcp": "vitest run tests/unit/mcp --exclude='**/mcp/handlers/domain-handlers.test.ts' --fileParallelism=false",

75 "test:e2e": "vitest run tests/integration/browser --testTimeout=120000",

76 "test:safe": "NODE_OPTIONS='--max-old-space-size=768 --expose-gc' vitest run --maxForks=1",

77 "test:dev": "npm run test:unit:fast",

78 "test:all": "npm test -- --run",

79 "test:mcp": "npm run test:unit:mcp",

80 "test:mcp:integration": "npm test -- --run tests/integration/mcp/",

Long lines were clipped for display.

.claude/agents/v3/subagents/qe-security-reviewer.mdView file

Lines 256-296markdown

256 const DB_PASSWORD = 'super_secret_password_123';

257 ```

258 - Type: Database credential

259 - Entropy: 3.2 (medium)

260 - Action: Rotate password

261 - Remediation: Use secrets manager

262

2633. **JWT Secret** (HIGH)

264 ```

265 // auth.ts:15

266 const JWT_SECRET = 'my-jwt-secret-key-very-long';

dist/init/enhancements/claude-flow-adapter.jsView file

Lines 90-130javascript

90 transfer: false,

91 };

92 }

93 // All features available when Claude Flow is present

94 return {

95 trajectories: true,

96 modelRouting: true,

dist/integrations/browser/web-content-fetcher.jsView file

Lines 1-41javascript

1/**

2 * Web Content Fetcher - V3 Browser Cascade

3 *

4 * Provides resilient web content fetching with a 5-tier cascade:

5 * 1. Vibium MCP Browser (best for bot-protected sites)

6 * 2. Agent Browser (CLI-based with refs)

7 * 3. Playwright + Stealth (headless with anti-detection)

8 * 4. Simple HTTP Fetch (for static sites)

9 * 5. Web Search Fallback (research-based, last resort)

10 *

dist/domains/security-compliance/services/security-auditor-sast.jsView file

Lines 31-71javascript

31 title: 'XSS via innerHTML Assignment',

32 description: 'Direct innerHTML assignment with potentially unsanitized content',

33 severity: 'high',

34 category: 'xss',

dist/init/phases/07-hooks.jsView file

Lines 174-214javascript

174 installHookAssets(hooksDir, context) {

175 const { projectRoot } = context;

176 // Install brain-checkpoint helper into .claude/helpers/

177 this.installBrainCheckpoint(projectRoot, context);

178 // Install statusline-v3 helper into .claude/helpers/

179

dist/cli/chunks/chunk-UFZCHVLH.jsView file

1import{createRequire as __cr}from"module";const require=__cr(import.meta.url);if(process.argv.includes('--version')||process.argv.includes('-v')){console.log("3.11.3");process.exit... L2: var N="ffffffff-ffff-ffff-ffff-ffffffffffff";var _="00000000-0000-0000-0000-000000000000";var y=/^(?:[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}|0000000...

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/cli/chunks/chunk-UFZCHVLH.jsView on unpkg · L1

dist/cli/chunks/completions-VRFFK223.jsView file

1import{createRequire as __cr}from"module";const require=__cr(import.meta.url);if(process.argv.includes('--version')||process.argv.includes('-v')){console.log("3.11.3");process.exit... L2: import"./chunk-PUK5NE47.js";import{Command as v}from"commander";import o from"chalk";var c=["test-generation","test-execution","coverage-analysis","quality-assessment","defect-inte... L3: # AQE CLI Bash Completion Script ... L55: local protocol_subcmds="run" L56: local completions_subcmds="bash zsh fish powershell install" L57: local brain_subcmds="export import info diff search witness-backfill" ... L1410: } L1411: `}function $(){let t=process.env.SHELL||"";if(process.env.PSVersionTable||process.env.PSModulePath)return{name:"powershell",configFile:process.platform==="win32"?`${process.env.USE... L1412: eval "$(aqe completions bash)"

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/cli/chunks/completions-VRFFK223.jsView on unpkg · L1

dist/cli/chunks/chunk-6WWNK67C.jsView file

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli/chunks/chunk-6WWNK67C.jsView on unpkg · L105

dist/cli/chunks/chunk-ZDPQB67L.jsView file

1import{createRequire as __cr}from"module";const require=__cr(import.meta.url);if(process.argv.includes('--version')||process.argv.includes('-v')){console.log("3.11.3");process.exit... L2: var P="quality-daemon",x=class{constructor(e){this.backend=e}backend;async get(e){return this.backend.kvGet(e,P)}async set(e,t){await this.backend.kvSet(e,t,P)}async search(e){retu... L3: `)){if(!i)continue;let[o,r]=i.split(" "),n=this.lastKnownHeads.get(o);n&&n!==r&&(e.push(o),await this.enqueueCommitAnalysis(o,r)),this.lastKnownHeads.set(o,r)}}catch{}finally{this.... L4: `).filter(Boolean).slice(0,this.options.maxChangedFiles)}catch{}let o={type:"git_commit",branch:e,commitHash:t,changedFiles:i},r={id:`git-${t}-${Date.now()}`,priority:"next",payloa... L5: `)){if(!t)continue;let[i,o]=t.split(" ");this.lastKnownHeads.set(i,o)}}catch{}}};var E={regressionThreshold:2,gapThreshold:60,memoryPrefix:"quality-daemon:coverage"},f=class{constr...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/cli/chunks/chunk-ZDPQB67L.jsView on unpkg · L1

assets/grammars/tree-sitter-python.wasmView file

•path = assets/grammars/tree-sitter-python.wasm kind = wasm_module sizeBytes = 460119 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

assets/grammars/tree-sitter-python.wasmView on unpkg

.claude/hooks/post-task-sync.shView file

•path = .claude/hooks/post-task-sync.sh kind = payload_in_excluded_dir sizeBytes = 3251 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.claude/hooks/post-task-sync.shView on unpkg

•path = .claude/hooks/post-task-sync.sh kind = build_helper sizeBytes = 3251 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

.claude/hooks/post-task-sync.shView on unpkg

dist/mcp/bundle.jsView file

•path = dist/mcp/bundle.js kind = oversized_source_file sizeBytes = 3750944 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/mcp/bundle.jsView on unpkg

•path = dist/mcp/bundle.js kind = oversized_cli_entrypoint sizeBytes = 3750944 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/mcp/bundle.jsView on unpkg

.claude/agents/core/reviewer.mdView file

151patternName = generic_password severity = medium line = 151 matchedText = console....rd);

Medium

Secret Pattern

Hardcoded password in .claude/agents/core/reviewer.md

.claude/agents/core/reviewer.mdView on unpkg · L151

.claude/agents/flow-nexus/authentication.mdView file

22patternName = generic_password severity = medium line = 22 matchedText = password...rd",

Medium

Secret Pattern

Hardcoded password in .claude/agents/flow-nexus/authentication.md

.claude/agents/flow-nexus/authentication.mdView on unpkg · L22

29patternName = generic_password severity = medium line = 29 matchedText = passwo...

Medium

Secret Pattern

Hardcoded password in .claude/agents/flow-nexus/authentication.md

.claude/agents/flow-nexus/authentication.mdView on unpkg · L29

43patternName = generic_password severity = medium line = 43 matchedText = new_pass...ord"

Medium

Secret Pattern

Hardcoded password in .claude/agents/flow-nexus/authentication.md

.claude/agents/flow-nexus/authentication.mdView on unpkg · L43

.claude/agents/v3/subagents/qe-tdd-red.mdView file

159patternName = generic_password severity = medium line = 159 matchedText = password...123'

Medium

Secret Pattern

Hardcoded password in .claude/agents/v3/subagents/qe-tdd-red.md

.claude/agents/v3/subagents/qe-tdd-red.mdView on unpkg · L159

171patternName = generic_password severity = medium line = 171 matchedText = const cr...' };

Medium

Secret Pattern

Hardcoded password in .claude/agents/v3/subagents/qe-tdd-red.md

.claude/agents/v3/subagents/qe-tdd-red.mdView on unpkg · L171

183patternName = generic_password severity = medium line = 183 matchedText = const cr...' };

Medium

Secret Pattern

Hardcoded password in .claude/agents/v3/subagents/qe-tdd-red.md

.claude/agents/v3/subagents/qe-tdd-red.mdView on unpkg · L183

249patternName = generic_password severity = medium line = 249 matchedText = const pa...23';

Medium

Secret Pattern

Hardcoded password in .claude/agents/v3/subagents/qe-tdd-red.md

.claude/agents/v3/qe-pentest-validator.mdView file

295patternName = generic_password severity = medium line = 295 matchedText = - passwo...tial

Medium

Secret Pattern

Hardcoded password in .claude/agents/v3/qe-pentest-validator.md

.claude/agents/v3/qe-pentest-validator.mdView on unpkg · L295

.claude/agents/sparc/refinement.mdView file

339patternName = generic_password severity = medium line = 339 matchedText = password...23!'

Medium

Secret Pattern

Hardcoded password in .claude/agents/sparc/refinement.md

.claude/agents/sparc/refinement.mdView on unpkg · L339

367patternName = generic_password severity = medium line = 367 matchedText = password...ord'

Medium

Secret Pattern

Hardcoded password in .claude/agents/sparc/refinement.md

.claude/agents/sparc/refinement.mdView on unpkg · L367

543patternName = generic_password severity = medium line = 543 matchedText = passwo...

Medium

Secret Pattern

Hardcoded password in .claude/agents/sparc/refinement.md

.claude/agents/sparc/refinement.mdView on unpkg · L543

.claude/skills/testability-scoring/resources/templates/config.template.jsView file

42patternName = generic_password severity = medium line = 42 matchedText = { userna...' },

Medium

Secret Pattern

Hardcoded password in .claude/skills/testability-scoring/resources/templates/config.template.js

.claude/skills/testability-scoring/resources/templates/config.template.jsView on unpkg · L42

43patternName = generic_password severity = medium line = 43 matchedText = { userna...' },

Medium

Secret Pattern

Hardcoded password in .claude/skills/testability-scoring/resources/templates/config.template.js

.claude/skills/testability-scoring/resources/templates/config.template.jsView on unpkg · L43

44patternName = generic_password severity = medium line = 44 matchedText = { userna...' },

Medium

Secret Pattern

Hardcoded password in .claude/skills/testability-scoring/resources/templates/config.template.js

.claude/skills/testability-scoring/resources/templates/config.template.jsView on unpkg · L44

.claude/skills/security-testing/SKILL.mdView file

128patternName = generic_password severity = medium line = 128 matchedText = await db... });

Medium

Secret Pattern

Hardcoded password in .claude/skills/security-testing/SKILL.md

.claude/skills/security-testing/SKILL.mdView on unpkg · L128

.claude/skills/n8n-security-testing/evals/n8n-security-testing.yamlView file

152patternName = generic_password severity = medium line = 152 matchedText = password...123"

Medium

Secret Pattern

Hardcoded password in .claude/skills/n8n-security-testing/evals/n8n-security-testing.yaml

.claude/skills/n8n-security-testing/evals/n8n-security-testing.yamlView on unpkg · L152

157patternName = generic_password severity = medium line = 157 matchedText = password...456"

Medium

Secret Pattern

Hardcoded password in .claude/skills/n8n-security-testing/evals/n8n-security-testing.yaml

.claude/skills/n8n-security-testing/evals/n8n-security-testing.yamlView on unpkg · L157

.claude/skills/flow-nexus-platform/SKILL.mdView file

33patternName = generic_password severity = medium line = 33 matchedText = password...rd",

Medium

Secret Pattern

Hardcoded password in .claude/skills/flow-nexus-platform/SKILL.md

.claude/skills/flow-nexus-platform/SKILL.mdView on unpkg · L33

43patternName = generic_password severity = medium line = 43 matchedText = password...ord"

Medium

Secret Pattern

Hardcoded password in .claude/skills/flow-nexus-platform/SKILL.md

.claude/skills/flow-nexus-platform/SKILL.mdView on unpkg · L43

agentic-qe@3.11.3

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code