registry / codeassembly / 0.8.0
codeassembly@0.8.0
⚠ Under reviewCLI that installs reusable AI agent guidance (rulebooks, skills, and subagents) into coding-harness directories
Static Scan Results
scanned 3mo ago · by rust-scannerStatic analysis flagged 13 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemShell
HighEntropyStringsMinifiedObfuscatedUrlStrings
Source & flagged code
5 flaggeddist/esm/derive-session-context/cli.jsView file
1import { execFile } from 'node:child_process';
L2: import { realpathSync } from 'node:fs';
High
Child Process
Package source references child process execution.
dist/esm/derive-session-context/cli.jsView on unpkg · L1bin/codeassembly.jsView file
20try {
L21: await import(entryPoint.href);
L22: } catch (error) {
Medium
Dynamic Require
Package source references dynamic require/import behavior.
bin/codeassembly.jsView on unpkg · L20dist/esm/kb-curate/apply/canonicalize-tags.jsView file
Findings
1 Critical3 High4 Medium5 Low
CriticalPrevious Version Dangerous Deltadist/content/skills/kb-add/kb-add.mjs
HighChild Processdist/esm/derive-session-context/cli.js
HighShell
HighCross File Remote Execution Contextdist/esm/kb-curate/apply/canonicalize-tags.js
MediumDynamic Requirebin/codeassembly.js
MediumEnvironment Vars
MediumShips Build Helperdist/content/scripts/resolve-merge-options.sh
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowObfuscated
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to codeassembly@0.8.0.
See all versions of codeassembly for other recorded verdicts.
- Review the evidence and your use of codeassembly@0.8.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.