agile-sddf@3.2.0
Agile Spec-Driven-Development Framework for AI agents
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe package is not malicious by static inspection, but its explicit command installs AI-agent configuration into project or home runtime folders. The firewall policy treats that first-party extension capability as a warning-level lifecycle risk.
Static reason
No blocking static signals were detected.
Trigger
A user runs agile-sddf install, optionally with --global and a declared target.
Impact
The command can modify selected project or home-directory AI runtime folders; this is an agent-extension lifecycle risk rather than covert install-time behavior.
Mechanism
Explicit, containment-checked copying of package-provided AI skills and agents.
AI rationale
The package is not malicious by static inspection, but its explicit command installs AI-agent configuration into project or home runtime folders. The firewall policy treats that first-party extension capability as a warning-level lifecycle risk.
Evidence
scripts/install.jsconfig/runtimes.json.claude/skills.claude/agents.opencode/skills.opencode/agents.github/skills.github/agents.agents/skills
Decision evidence
public snapshotAI called this Suspicious at 92.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The explicit install command copies packaged skills and, for agent-capable targets, agent files into declared AI runtime folders.
- The manifest exposes a bin command but declares no npm preinstall, install, or postinstall lifecycle hook.
- The high-scanner finding is a plaintext pytest fixture containing a dummy token and an intentionally failing assertion, not an executable payload.
Evidence against
- No automatic install-time execution, credential harvesting, network access, dynamic code execution, or self-dependency was found in the inspected package runtime path.
- The control-surface writes are limited to an explicit user command, declared runtime targets, and containment-checked destinations.
Behavioral surface
ChildProcessEnvironmentVarsFilesystem
HighEntropyStringsUrlStrings
Source & flagged code
6 flagged · loading sourceskills/story-verify/examples/pytest-project/tests/test_auth.pyView file
•path = skills/story-verify/examples/pytest-project/tests/test_auth.py
kind = payload_in_excluded_dir
sizeBytes = 630
magicHex = [redacted]
High
Payload In Excluded Dir
Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.
skills/story-verify/examples/pytest-project/tests/test_auth.pyView on unpkg•path = skills/story-verify/examples/pytest-project/tests/test_auth.py
kind = build_helper
sizeBytes = 630
magicHex = [redacted]
Medium
Ships Build Helper
Package ships non-JavaScript build or shell helper files.
skills/story-verify/examples/pytest-project/tests/test_auth.pyView on unpkgscripts/verify-release.jsView file
•stage = ast_semantic_analysis; reason = ast_trace_path_limit_exceeded; limitedFiles = 1
Findings
2 High6 Medium4 Low
HighPayload In Excluded Dirskills/story-verify/examples/pytest-project/tests/test_auth.py
HighSemantic Analysis Limitedscripts/verify-release.js
MediumEnvironment Vars
MediumShips Build Helperskills/story-verify/examples/pytest-project/tests/test_auth.py
MediumStructural Risk Force Deep Review
MediumAi Review Evidencescripts/install.js
MediumAi Review Evidenceconfig/runtimes.json
MediumSuspicious Lifecycle Evidencepackage.json
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to agile-sddf@3.2.0.
See all versions of agile-sddf for other recorded verdicts.
- Review the evidence and your use of agile-sddf@3.2.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.