registry  /  gentle-pi  /  1.0.4

gentle-pi@1.0.4

Turn Pi into el Gentleman: a senior-architect development harness with SDD/OpenSpec, subagents, strict TDD evidence, review guardrails, and skill discovery.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
Supply chain
HighEntropyStringsUrlStrings
Manifest
WildcardDependency
scanned 101 file(s), 1.71 MB of source, external domains: example.invalid, github.com, malformed.example

Source & flagged code

4 flagged · loading source
package.jsonView file
•scripts.postinstall = node scripts/install-gentle-ai.mjs
High
Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg
tests/review-bundle.test.tsView file
54const importer = new ReviewBundleImporter(target, { mutationLockPlatform: qualifiedReviewLockPlatform() }); L55: const imported = importer.import({ inputPath: first, operationId: "import-one", [redacted]: true }); L56: assert.equal(imported.imported, true);
Medium
Dynamic Require

Package source references dynamic require/import behavior.

tests/review-bundle.test.tsView on unpkg · L54
extensions/skill-registry.tsView file
54function userSkillDirs(): string[] { L55: const home = homedir(); L56: return [ ... L127: L128: function parseFrontmatter(source: string): { name?: string; description?: string; body: string } { L129: const normalized = source.replace(/\r\n?/g, "\n"); ... L384: try { L385: const parsed: unknown = JSON.parse(await readFile(cachePath, "utf8")); L386: cached = isCacheFile(parsed) ? parsed.fingerprint : undefined; ... L427: argv = process.argv.slice(2), L428: env = process.env, L429: ): boolean {
Low
Weak Crypto

Package source references weak cryptographic algorithms.

extensions/skill-registry.tsView on unpkg · L54
extensions/gentle-ai.tsView file
•matchType = previous_version_dangerous_delta matchedPackage = gentle-pi@1.0.1 matchedIdentity = npm:Z2VudGxlLXBp:1.0.1 similarity = 0.679 summary = stored previous version shares package body but lacks this dangerous source file
High
Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

extensions/gentle-ai.tsView on unpkg

Findings

2 High5 Medium5 Low
HighInstall Time Lifecycle Scriptspackage.json
HighPrevious Version Dangerous Deltaextensions/gentle-ai.ts
MediumDynamic Requiretests/review-bundle.test.ts
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumWildcard Dependency
LowScripts Present
LowWeak Cryptoextensions/skill-registry.ts
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings