registry / agile-sddf / 3.3.1
agile-sddf@3.3.1
Agile Spec-Driven-Development Framework for AI agents
AI Security Review
scanned 15d ago · by lpm-firewall-aiStatic inspection found no malicious behavior in the manifest or required finding paths. Scanner hints correspond to a test fixture and package verification/evaluation tooling, with no install-time execution shown.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Trigger
The CLI runs when invoked; evaluation processes run when the evaluation script is explicitly invoked.
Impact
No confirmed malicious effect or attack surface was established in the inspected source.
Mechanism
The manifest defines a CLI entrypoint but no install lifecycle hook. Inspected scripts perform release checks or run an evaluation command.
AI rationale
Static inspection found no malicious behavior in the manifest or required finding paths. Scanner hints correspond to a test fixture and package verification/evaluation tooling, with no install-time execution shown.
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes a CLI and ordinary test and verification scripts; it declares no preinstall, install, or postinstall hook.
- The flagged Python file is a small pytest example that checks successful and failed login results; it contains no executable payload behavior.
- The release verifier reads package and lockfile metadata and checks version and changelog consistency.
- The eval runner starts a supplied command with arguments in the repository directory as part of its documented evaluation workflow.
Evidence against
Behavioral surface
ChildProcessEnvironmentVarsFilesystem
HighEntropyStringsUrlStrings
Source & flagged code
6 flagged · loading sourceskills/story-verify/examples/pytest-project/tests/test_auth.pyView file
•path = skills/story-verify/examples/pytest-project/tests/test_auth.py
kind = payload_in_excluded_dir
sizeBytes = 630
magicHex = [redacted]
High
Payload In Excluded Dir
Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.
skills/story-verify/examples/pytest-project/tests/test_auth.pyView on unpkg•path = skills/story-verify/examples/pytest-project/tests/test_auth.py
kind = build_helper
sizeBytes = 630
magicHex = [redacted]
Medium
Ships Build Helper
Package ships non-JavaScript build or shell helper files.
skills/story-verify/examples/pytest-project/tests/test_auth.pyView on unpkg4def test_login_success():
"""Successful login returns a token."""
result = {"token": "abc123", "user_id": 1}
assert result["token"] is not None
assert result["user_id"] =
Low
Ai Review Evidence
Findings
3 High3 Medium6 Low
HighPayload In Excluded Dirskills/story-verify/examples/pytest-project/tests/test_auth.py
HighSemantic Analysis Limitedscripts/verify-release.js
HighPrevious Version Dangerous Deltascripts/run-evals.js
MediumEnvironment Vars
MediumShips Build Helperskills/story-verify/examples/pytest-project/tests/test_auth.py
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidenceskills/story-verify/examples/pytest-project/tests/test_auth.py
Affected versions and remediation
This report applies to agile-sddf@3.3.1.
See all versions of agile-sddf for other recorded verdicts.
- Review the evidence and your use of agile-sddf@3.3.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.