agile-sddf@4.0.1

Agile Spec-Driven-Development Framework for AI agents

AI Security Review

scanned 8d ago · by lpm-firewall-ai

The inspected manifest has no lifecycle hook, and the flagged source files contain a test fixture and release consistency checks. The available runtime path is an explicit, destination-bounded content installer; no malicious behavior was identified.

Static reason

No blocking static signals were detected.

Trigger

No automatic install or import trigger was identified; file installation runs through the explicit CLI install command.

Impact

No confirmed harmful effect or attack surface was established.

Mechanism

The installer copies package skills and compatible agents to a selected, contained destination.

AI rationale

Decision evidence

public snapshot

AI called this Clean at 92.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json defines a CLI entry point and contains no install lifecycle hook.
The flagged Python file is a login test fixture with sample values and assertions.
scripts/verify-release.js checks dependency metadata, versions, and changelog consistency.
The CLI runs installation only for the explicit install command; the installer copies package skills and compatible agents to a bounded selected destination.

Evidence against

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystem

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 27 file(s), 318 KB of source, external domains: github.com

Source & flagged code

6 flagged

skills/story-verify/examples/pytest-project/tests/test_auth.pyView file

Lines 1-16text

1# Test example for story-verify: pytest project

2# Used as input fixture to verify skill detects pytest and runs tests

4def test_login_success():

5 """Successful login returns a token."""

6 result = {"token": "abc123", "user_id": 1}

7 assert result["token"] is not None

8 assert result["user_id"] == 1

Low

Ai Review Evidence

The flagged Python file is a login test fixture with sample values and assertions.

skills/story-verify/examples/pytest-project/tests/test_auth.pyView on unpkg · L4

11def test_login_failure():

12 """Invalid credentials raise an error — this test is intentionally failing."""

13 # This test FAILS to demonstrate the VERIFY BLOQUEADO path (AC-5)

14 result = {"token": None, "error": "invalid_credentials"}

15 assert result["token"] is not None # intentional failure

•path = skills/story-verify/examples/pytest-project/tests/test_auth.py kind = payload_in_excluded_dir sizeBytes = 615 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

skills/story-verify/examples/pytest-project/tests/test_auth.pyView on unpkg

•path = skills/story-verify/examples/pytest-project/tests/test_auth.py kind = build_helper sizeBytes = 615 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/story-verify/examples/pytest-project/tests/test_auth.pyView on unpkg

scripts/verify-release.jsView file

Lines 8-48javascript

9const REPO_ROOT = path.resolve(__dirname, '..');

11function readJson(file, errors, label) {

12 try {

package.jsonView file

Lines 11-51json

11 "spec-driven-development",

12 "claude-code",

13 "ai-agents",

14 "user-stories"

15 ],

16 "license": "MIT",

17 "repository": {

Source & flagged code

6 flagged · loading source

skills/story-verify/examples/pytest-project/tests/test_auth.pyView file

•path = skills/story-verify/examples/pytest-project/tests/test_auth.py kind = payload_in_excluded_dir sizeBytes = 615 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

skills/story-verify/examples/pytest-project/tests/test_auth.pyView on unpkg

•path = skills/story-verify/examples/pytest-project/tests/test_auth.py kind = build_helper sizeBytes = 615 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/story-verify/examples/pytest-project/tests/test_auth.pyView on unpkg

4def test_login_success(): """Successful login returns a token.""" result = {"token": "abc123", "user_id": 1} assert result["token"] is not None assert result["user_

Low

Ai Review Evidence

Findings

2 High3 Medium7 Low

HighPayload In Excluded Dirskills/story-verify/examples/pytest-project/tests/test_auth.py

HighSemantic Analysis Limitedscripts/verify-release.js

MediumEnvironment Vars

MediumShips Build Helperskills/story-verify/examples/pytest-project/tests/test_auth.py

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowSuspicious Lifecycle Evidencepackage.json

LowAi Review Evidenceskills/story-verify/examples/pytest-project/tests/test_auth.py

LowSuspicious Dependency Evidencescripts/verify-release.js

Affected versions and remediation

This report applies to agile-sddf@4.0.1.

See all versions of agile-sddf for other recorded verdicts.

Review the evidence and your use of agile-sddf@4.0.1 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-15 04:28:04.475Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.