registry / brainforge-kit / 0.3.0-beta.2

brainforge-kit@0.3.0-beta.2

⚠ Under review

Conversational workspaces, agents and workflows for AI assistants.

Static Scan Results

scanned 9d ago · by rust-scanner

Static analysis completed at 72.0% confidence. No malicious behavior was detected; 13 low-signal pattern(s) were surfaced and cleared.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 115 file(s), 991 KB of source, external domains: 127.0.0.1, api.typesafe.ai, docs.typesafe.ai, example.com, learn.chatgpt.com, motion.dev, openrouter.ai, vercel.com

Source & flagged code

6 flagged

init-project.mjsView file

Lines 1-25javascript

1import fs from 'node:fs';

2import path from 'node:path';

3import { randomUUID } from 'node:crypto';

4import { createHash } from 'node:crypto';

5import { fileURLToPath } from 'node:url';

6import { spawnSync } from 'node:child_process';

High

Child Process

Package source references child process execution.

init-project.mjsView on unpkg · L5

8const source = path.dirname(fileURLToPath(import.meta.url));

9const directories = ['agent-kit', 'business-os', 'docs', 'onboarding', 'runtime'];

10const files = ['LICENSE', 'THIRD_PARTY_NOTICES.md', 'README.md', 'kit.json'];

11const manifestName = 'kit-manifest.json';

12const startText = `---\nname: brainforge-start\ndescription: Start or resume Brainforge in this project.\n---\n\n# Start Brainforge\n\nRead .brainforge/kit/onboarding/SETUP.md and follow it. The project root is the current directory. Store Brainforge's private context in .brainforge/workspace/; preserve existing project files and instructions. Continue the user's current goal.\n`;

13const instruction = `\nWhen the user says start or asks to use Brainforge, read .brainforge/kit/onboarding/SETUP.md. This is an existing project: the project root is this directory, while the kit lives in .brainforge/kit. Keep private Brainforge context in .brainforge/workspace/ and preserve all existing project instructions and files. Resume the user's current goal; do not start a fresh-project generator. When a later request materially changes the goal, revisit relevant skills and specialists for the next task. At a task boundary, run brainforge-kit sync plan for tha ...

14const installedNote = `> **Installed in an existing project:** The working project root is the directory containing .brainforge/, not this kit folder. Read source procedures and catalog files from .brainforge/kit/; write the four private context files under .brainforge/workspace/ in the project root. Treat every mention of \`workspace/\` in this workflow as \`.brainforge/workspace/\`

16function ensureLocalDirectory(target) {

17 if (!fs.existsSync(target) || !fs.statSync(target).isDirectory()) throw new Error('The target must be an existing project directory.');

18 for (const rel of ['', '.brainforge', '.brainforge/kit', '.brainforge/workspace', '.brainforge/workspace/kit-backups', '.agents', '.agents/skills', '.agents/skills/brainforge-start', '.claude', '.claude/agents', '.claude/skills', '.claude/skills/brainforge-start', '.codex', 'AGENTS.md', 'CLAUDE.md', '.gitignore', '.claude/settings.json', '.codex/hooks.json']) {

19 const part = path.join(target, rel);

20 if (!fs.existsSync(part)) continue;

21 const stat = fs.lstatSync(part);

22 if (stat.isSymbolicLink()) throw new Error(`Refusing symbolic-link destination: ${part}`);

23 if (rel && !rel.endsWith('.md') && !rel.endsWith('.json') && rel !== '.gitignore' && !stat.isDirectory()) throw new Error(`Expected a directory: ${part}`);

24 if ((rel.endsWith('.md') || rel.endsWith('.json') || rel === '.gitignore') && !stat.isFile()) throw new Error(`Expected a regular file: ${part}`);

25 }

Long lines were clipped for display.

onboarding/skills/premium-web-design/tests/reveal.browser.check.mjsView file

Lines 12-43javascript

12 await page.addScriptTag({ path: fileURLToPath(new URL('../assets/motion-lab/vendor/motion-13.4.4.js', import.meta.url)) });

13 await page.addScriptTag({ path: fileURLToPath(

runtime/scope-verify.mjsView file

Lines 19-59javascript

19// node runtime/scope-verify.mjs --owners src/a.tsx --root <project>

20// node runtime/scope-verify.mjs --scopes-drift --root <project> [--strict]

21// node runtime/scope-verify.mjs --catalog-scopes --track web-saas [--agents a,b] [--project name]

22// Exit 0 = nothing denied, 2 = at least one denial, 1 = could not verify.

23import fs from "node:fs";

24import path from "node:path";

onboarding/skills/premium-web-design/tests/integrity.check.mjsView file

Lines 1-28javascript

1import test from 'node:test';

2import assert from 'node:assert/strict';

3import { readFile, readdir } from 'node:fs/promises';

4import { createHash } from

agent-kit/hooks/scope-guard.mjsView file

Lines 1102-1142javascript

1102 continue;

1103 }

1104 if (first === "case" && !tokens[0].quoted) {

1105 const arm =

runtime/catalog-index.mjs#virtual:string-array:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

runtime/catalog-index.mjs#virtual:string-array:round1View on unpkg

Source & flagged code

6 flagged · loading source

init-project.mjsView file

brainforge-kit@0.3.0-beta.2

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code