agile-sddf@3.1.1
Published with invalid self-dependency. Use 3.1.2, 3.1.0. or latest (last version)
Agile Spec-Driven-Development Framework for AI agents
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe package exposes an explicit capability to modify AI-agent control surfaces, including global destinations, but source inspection found no automatic lifecycle trigger, network activity, exfiltration, or payload execution. The self-dependency is concerning metadata but does not form a lifecycle chain in this release.
Static reason
No blocking static signals were detected.
Trigger
The user runs agile-sddf install, optionally with --global or --force.
Impact
Installed definitions can influence the selected AI-agent runtime; force can replace existing files in those destination directories.
Mechanism
Explicit copying of agent and skill definitions into configured runtime directories.
AI rationale
The package exposes an explicit capability to modify AI-agent control surfaces, including global destinations, but source inspection found no automatic lifecycle trigger, network activity, exfiltration, or payload execution. The self-dependency is concerning metadata but does not form a lifecycle chain in this release.
Evidence
scripts/cli.jsscripts/install.jsconfig/runtimes.json.claude/skills.claude/agents.config/opencode/skills.config/opencode/agents.copilot/skills.copilot/agents
Decision evidence
public snapshotAI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The user-invoked CLI installs skills and agent definitions into AI-agent runtime directories.
- The installer supports global destinations and can overwrite existing runtime files when forced.
- The manifest contains a file-based dependency on an earlier release of itself.
Evidence against
- package.json has no preinstall, install, or postinstall lifecycle entry.
- The CLI only calls the installer after the explicit install command.
- No source evidence shows credential harvesting, exfiltration, remote payload loading, or shell execution in the install path.
- The flagged pytest file is a readable test fixture with an intentional assertion failure, not a payload.
Behavioral surface
ChildProcessEnvironmentVarsFilesystem
HighEntropyStringsUrlStrings
Source & flagged code
6 flagged · loading sourceskills/story-verify/examples/pytest-project/tests/test_auth.pyView file
•path = skills/story-verify/examples/pytest-project/tests/test_auth.py
kind = payload_in_excluded_dir
sizeBytes = 630
magicHex = [redacted]
High
Payload In Excluded Dir
Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.
skills/story-verify/examples/pytest-project/tests/test_auth.pyView on unpkg•path = skills/story-verify/examples/pytest-project/tests/test_auth.py
kind = build_helper
sizeBytes = 630
magicHex = [redacted]
Medium
Ships Build Helper
Package ships non-JavaScript build or shell helper files.
skills/story-verify/examples/pytest-project/tests/test_auth.pyView on unpkgscripts/verify-release.jsView file
•stage = ast_semantic_analysis; reason = ast_trace_path_limit_exceeded; limitedFiles = 1
Findings
2 High6 Medium4 Low
HighPayload In Excluded Dirskills/story-verify/examples/pytest-project/tests/test_auth.py
HighSemantic Analysis Limitedscripts/verify-release.js
MediumEnvironment Vars
MediumShips Build Helperskills/story-verify/examples/pytest-project/tests/test_auth.py
MediumStructural Risk Force Deep Review
MediumAi Review Evidencescripts/cli.js
MediumAi Review Evidenceconfig/runtimes.json
MediumSuspicious Dependency Evidencepackage.json
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to agile-sddf@3.1.1.
See all versions of agile-sddf for other recorded verdicts.
- Review the evidence and your use of agile-sddf@3.1.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.