registry / ai-squad / 0.2.0

ai-squad@0.2.0

Interactive CLI to scaffold AI agent infrastructure for new projects

Static Scan Results

scanned 1h ago · by rust-scanner

Static analysis flagged 9 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 33.6 KB of source, external domains: mcp.context7.com, opencode.ai

Source & flagged code

2 flagged

dist/index.jsView file

Lines 808-848javascript

808 if (exists) {

809 const existing = await readFile2(absolutePath, "utf-8");

810 if (existing === content) {

811 return "skipped";

812 }

813 if (promptUser) {

814 const overwrite = await promptUser(

815 `File ${pc.yellow(relPath)} already exists. Overwrite?`

816 );

817 if (!overwrite) return "skipped";

818 }

819 await writeFile(absolutePath, content, "utf-8");

820 return "overwritten";

821 }

822 await writeFile(absolutePath, content, "utf-8");

823 return "created";

824}

825

826// src/wizard.ts

827import { resolve as resolve3 } from "path";

828import { mkdir as mkdir2, access as access2 } from "fs/promises";

829import { execSync } from "child_process";

830async function runWizard() {

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L828

831 intro(pc2.bold(pc2.cyan("ai-squad init")));

832 const projectName = await text({

833 message: "Project name?",

834 placeholder: "my-awesome-app",

835 validate(value) {

836 if (!value) return "Required.";

837 if (!/^[a-z0-9-]+$/.test(value)) return "Lowercase letters, numbers, and hyphens only.";

838 }

839 });

840 if (isCancel(projectName)) {

841 cancel("Cancelled.");

842 process.exit(0);

843 }

844 const allTech = getTechStacks();

845 const techStack = await multiselect({

846 message: "Tech stack? (space to select, enter to confirm)",

847 options: allTech.map((t) => ({ value: t, label: t.charAt(0).toUpperCase() + t.slice(1) })),

848 required: false

Lines 985-1025javascript

985 clearCache();

986 let created = 0;

987 let skipped = 0;

988 for (const file of files) {

989 const result = await writeFileSafe(projectDir, file.path, file.content, dryRun);

Source & flagged code

2 flagged · loading source

dist/index.jsView file

828import { mkdir as mkdir2, access as access2 } from "fs/promises"; L829: import { execSync } from "child_process"; L830: async function runWizard() {

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L828

1005try { L1006: execSync(cmd, { cwd: projectDir, stdio: "pipe" }); L1007: console.log(pc2.green(` \u2713 Installed`)); L1008: } catch { L1009: console.log(pc2.yellow(` \u26A0 Skipped \u2014 npx skills may not be available`)); L1010: }

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.jsView on unpkg · L1005

Findings

3 High1 Medium5 Low

HighChild Processdist/index.js

HighShell

HighRuntime Package Installdist/index.js

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

dist/index.jsView file

Lines 808-848javascript

808 if (exists) {

809 const existing = await readFile2(absolutePath, "utf-8");

810 if (existing === content) {

811 return "skipped";

812 }

813 if (promptUser) {

814 const overwrite = await promptUser(

815 `File ${pc.yellow(relPath)} already exists. Overwrite?`

816 );

817 if (!overwrite) return "skipped";

818 }

819 await writeFile(absolutePath, content, "utf-8");

820 return "overwritten";

821 }

822 await writeFile(absolutePath, content, "utf-8");

823 return "created";

824}

825

826// src/wizard.ts

827import { resolve as resolve3 } from "path";

828import { mkdir as mkdir2, access as access2 } from "fs/promises";

829import { execSync } from "child_process";

830async function runWizard() {

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L828

831 intro(pc2.bold(pc2.cyan("ai-squad init")));

832 const projectName = await text({

833 message: "Project name?",

834 placeholder: "my-awesome-app",

835 validate(value) {

836 if (!value) return "Required.";

837 if (!/^[a-z0-9-]+$/.test(value)) return "Lowercase letters, numbers, and hyphens only.";

838 }

839 });

840 if (isCancel(projectName)) {

841 cancel("Cancelled.");

842 process.exit(0);

843 }

844 const allTech = getTechStacks();

845 const techStack = await multiselect({

846 message: "Tech stack? (space to select, enter to confirm)",

847 options: allTech.map((t) => ({ value: t, label: t.charAt(0).toUpperCase() + t.slice(1) })),

848 required: false

Lines 985-1025javascript

985 clearCache();

986 let created = 0;

987 let skipped = 0;

988 for (const file of files) {

989 const result = await writeFileSafe(projectDir, file.path, file.content, dryRun);