aislop@0.18.1
Catch the slop AI coding agents leave in your code: narrative comments, swallowed exceptions, as-any casts, dead code, oversized functions. 50+ rules across 10 language targets (TypeScript, JavaScript, Expo / React Native, Python, Go, Rust, Ruby, PHP, C#,
AI Security Review
scanned 18d ago · by lpm-firewall-aiThe source does not substantiate the scanner’s credential-redirection hint. The CLI, MCP server, and framework adapter expose user-invoked package functions, and the manifest has no install lifecycle hook.
Decision evidence
public snapshot- package.json points to CLI, MCP, and tools entrypoints; its scripts show no install lifecycle hook.
- The flagged agent setup writes configuration only through the CLI install command, which selects agents and scope when invoked.
- The flagged index.js location resolves local Claude configuration paths; the public library exports analysis and project commands, not that installer.
- The MCP server exposes scan, fix, why, and baseline tools over standard input/output.
- The framework adapter runs only when explicitly enabled and defaults to scan or CI commands.
- The runtime telemetry endpoint is EU PostHog, and telemetry can be disabled through configuration or environment settings.
Source & flagged code
6 flaggedPackage source references child process execution.
dist/core-D4295PVP.jsView on unpkg · L1This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/cli.jsView on unpkgFindings
Affected versions and remediation
This report applies to aislop@0.18.1.
See all versions of aislop for other recorded verdicts.
- Review the evidence and your use of aislop@0.18.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.