agile-sddf@3.1.0
Agile Spec-Driven-Development Framework for AI agents
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThis is a first-party, explicit-user-command AI-agent extension installer rather than an automatic install hook. Conservatively warn for the extension capability; the inspected source does not establish malware or exfiltration.
Static reason
No blocking static signals were detected.
Trigger
The user runs agile-sddf install, optionally with --global and a runtime target.
Impact
It changes the selected project or user-level AI-agent extension surface.
Mechanism
User-invoked copying of bundled agent-extension files.
AI rationale
This is a first-party, explicit-user-command AI-agent extension installer rather than an automatic install hook. Conservatively warn for the extension capability; the inspected source does not establish malware or exfiltration.
Evidence
scripts/cli.jsscripts/install.jsconfig/runtimes.json.claude/skills.claude/agents.config/opencode/skills.config/opencode/agents.github/skills.github/agents.copilot/skills.copilot/agents
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The package exposes a CLI whose install command copies bundled skills and agents into AI-agent runtime directories.
- The runtime contract targets Claude Code, OpenCode, and GitHub Copilot control directories, including project and global locations.
- The agent-surface write is activated only by an explicit user CLI command; no npm lifecycle hook is declared.
- The high-signal Python path is a readable pytest fixture with an intentionally failing assertion, not an opaque payload.
- The release-check script only reads local metadata and changelog files.
Evidence against
- No preinstall, install, or postinstall script is declared in the manifest.
- No secret collection, network exfiltration, dynamic code execution, or self-dependency was found.
- The shipped postinstall helper performs no writes and is not registered as a lifecycle hook.
Behavioral surface
ChildProcessEnvironmentVarsFilesystem
HighEntropyStrings
Source & flagged code
6 flagged · loading sourceskills/story-verify/examples/pytest-project/tests/test_auth.pyView file
•path = skills/story-verify/examples/pytest-project/tests/test_auth.py
kind = payload_in_excluded_dir
sizeBytes = 630
magicHex = [redacted]
High
Payload In Excluded Dir
Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.
skills/story-verify/examples/pytest-project/tests/test_auth.pyView on unpkg•path = skills/story-verify/examples/pytest-project/tests/test_auth.py
kind = build_helper
sizeBytes = 630
magicHex = [redacted]
Medium
Ships Build Helper
Package ships non-JavaScript build or shell helper files.
skills/story-verify/examples/pytest-project/tests/test_auth.pyView on unpkgscripts/verify-release.jsView file
•stage = ast_semantic_analysis; reason = ast_trace_path_limit_exceeded; limitedFiles = 1
Findings
2 High6 Medium4 Low
HighPayload In Excluded Dirskills/story-verify/examples/pytest-project/tests/test_auth.py
HighSemantic Analysis Limitedscripts/verify-release.js
MediumEnvironment Vars
MediumShips Build Helperskills/story-verify/examples/pytest-project/tests/test_auth.py
MediumStructural Risk Force Deep Review
MediumAi Review Evidencepackage.json
MediumAi Review Evidencescripts/install.js
MediumAi Review Evidenceconfig/runtimes.json
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to agile-sddf@3.1.0.
See all versions of agile-sddf for other recorded verdicts.
- Review the evidence and your use of agile-sddf@3.1.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.