agile-sddf@4.1.0

Agile Spec-Driven-Development Framework for AI agents

AI Security Review

scanned 6d ago · by lpm-firewall-ai

Source inspection found no install lifecycle hook or runtime self-dependency; the flagged Python file is a test fixture, and installation requires an explicit CLI command. The scanner hints do not establish malicious behavior.

Static reason

No blocking static signals were detected.

Trigger

A user runs the package CLI install command.

Impact

No confirmed harmful effect; the described installation is a user-invoked file copy.

Mechanism

The installer copies package-owned skills and compatible agents into validated runtime destinations.

AI rationale

Evidence

skills/story-verify/examples/pytest-project/tests/test_auth.pyscripts/cli.jsscripts/install.jsscripts/verify-release.js

Decision evidence

public snapshot

AI called this Clean at 95.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The manifest declares a CLI entry point and development scripts, with no install lifecycle hook; its only dependency is a filesystem utility.
The flagged Python file is a small pytest example fixture, not executable package installation code.
The release verifier checks for self-dependencies and reports them as errors.
Installation is an explicit CLI command that copies package files into validated runtime destinations; global installation requires an explicit option.

Evidence against

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystem

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 27 file(s), 319 KB of source, external domains: github.com

Source & flagged code

6 flagged

skills/story-verify/examples/pytest-project/tests/test_auth.pyView file

Lines 1-16text

1# Test example for story-verify: pytest project

2# Used as input fixture to verify skill detects pytest and runs tests

4def test_login_success():

Low

Ai Review Evidence

The flagged Python file is a small pytest example fixture, not executable package installation code.

skills/story-verify/examples/pytest-project/tests/test_auth.pyView on unpkg · L1

5 """Successful login returns a token."""

6 result = {"token": "abc123", "user_id": 1}

7 assert result["token"] is not None

8 assert result["user_id"] == 1

11def test_login_failure():

12 """Invalid credentials raise an error — this test is intentionally failing."""

13 # This test FAILS to demonstrate the VERIFY BLOQUEADO path (AC-5)

14 result = {"token": None, "error": "invalid_credentials"}

15 assert result["token"] is not None # intentional failure

•path = skills/story-verify/examples/pytest-project/tests/test_auth.py kind = payload_in_excluded_dir sizeBytes = 615 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

skills/story-verify/examples/pytest-project/tests/test_auth.pyView on unpkg

•path = skills/story-verify/examples/pytest-project/tests/test_auth.py kind = build_helper sizeBytes = 615 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/story-verify/examples/pytest-project/tests/test_auth.pyView on unpkg

scripts/verify-release.jsView file

•stage = ast_semantic_analysis; reason = ast_trace_path_limit_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

scripts/verify-release.jsView on unpkg

package.jsonView file

Lines 10-59json

10 "framework",

11 "spec-driven-development",

12 "claude-code",

13 "ai-agents",

14 "user-stories"

15 ],

16 "license": "MIT",

Source & flagged code

6 flagged · loading source

skills/story-verify/examples/pytest-project/tests/test_auth.pyView file

•path = skills/story-verify/examples/pytest-project/tests/test_auth.py kind = payload_in_excluded_dir sizeBytes = 615 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

skills/story-verify/examples/pytest-project/tests/test_auth.pyView on unpkg

•path = skills/story-verify/examples/pytest-project/tests/test_auth.py kind = build_helper sizeBytes = 615 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/story-verify/examples/pytest-project/tests/test_auth.pyView on unpkg

1# Test example for story-verify: pytest project # Used as input fixture to verify skill detects pytest and runs tests def test_lo

Low

Ai Review Evidence

The flagged Python file is a small pytest example fixture, not executable package installation code.

Findings

2 High3 Medium7 Low

HighPayload In Excluded Dirskills/story-verify/examples/pytest-project/tests/test_auth.py

HighSemantic Analysis Limitedscripts/verify-release.js

MediumEnvironment Vars

MediumShips Build Helperskills/story-verify/examples/pytest-project/tests/test_auth.py

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowSuspicious Lifecycle Evidencepackage.json

LowAi Review Evidenceskills/story-verify/examples/pytest-project/tests/test_auth.py

Affected versions and remediation

This report applies to agile-sddf@4.1.0.

See all versions of agile-sddf for other recorded verdicts.

Review the evidence and your use of agile-sddf@4.1.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-16 23:05:11.216Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.