aislop@0.17.0
Catch the slop AI coding agents leave in your code: narrative comments, swallowed exceptions, as-any casts, dead code, oversized functions. 50+ rules across 10 language targets (TypeScript, JavaScript, Expo / React Native, Python, Go, Rust, Ruby, PHP, C#,
AI Security Review
scanned 18d ago · by lpm-firewall-aiThe manifest has no install lifecycle hook, and the flagged agent configuration code is part of explicit CLI setup. Inspected telemetry code sends allowlisted usage properties and supports disabling telemetry; the scanner hints do not establish malicious behavior.
Decision evidence
public snapshot- package.json defines CLI entrypoints and contains no preinstall, install, or postinstall hook.
- The agent configuration locations resolve to Claude settings and rules files; the installer updates these through an explicit CLI operation.
- Telemetry has disable controls and sends redacted, allowlisted properties; the MCP entrypoint and framework adapter show ordinary package functionality.
Source & flagged code
6 flaggedPackage source references child process execution.
dist/core-D4295PVP.jsView on unpkg · L1This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/cli.jsView on unpkgFindings
Affected versions and remediation
This report applies to aislop@0.17.0.
See all versions of aislop for other recorded verdicts.
- Review the evidence and your use of aislop@0.17.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.