registry / izanagi-ai / 2.7.0

izanagi-ai@2.7.0

Izanagi AI - Modular Skill-Oriented AI Prompt & Agent Framework for Autonomous Software Engineering

Static Scan Results

scanned 2mo ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 23 file(s), 109 KB of source, external domains: opencode.ai

Source & flagged code

3 flagged

dist/scripts/verify-build.jsView file

Lines 1-21javascript

1import { execSync } from 'child_process';

2import fs from 'fs';

High

Child Process

Package source references child process execution.

dist/scripts/verify-build.jsView on unpkg · L1

3import path from 'path';

4import { fileURLToPath, pathToFileURL } from 'url';

5const __filename = fileURLToPath(import.meta.url);

6const __dirname = path.dirname(__filename);

7const rootDir = path.resolve(__dirname, '..', '..');

8try {

9 console.log('\n\x1b[36m=== 🧪 Testando Instalação em Projeto Fictício ===\x1b[0m\n');

10 // 1. Garantir que o build está pronto

11 execSync('npm run build', { cwd: rootDir, stdio: 'inherit' });

12 // 2. Criar diretório sandbox de teste

13 const sandboxDir = path.join(rootDir, 'tmp-sandbox-test');

14 if (fs.existsSync(sandboxDir)) {

15 fs.rmSync(sandboxDir, { recursive: true, force: true });

16 }

17 fs.mkdirSync(sandboxDir, { recursive: true });

18 // 3. Executar instalador simulando projeto de usuário (instala todos os packs)

19 const installerPath = path.join(rootDir, 'dist', 'installer.js');

20 const installerUrl = pathToFileURL(installerPath).href;

21 const packIds = `['core','agents','skills','architecture','coding','database','devops','security','testing','memory','optimization','teaching']`;

dist/scripts/build-clean.jsView file

Lines 1-23javascript

1import { execSync } from 'child_process';

2import fs from 'fs';

3import path from 'path';

4import { fileURLToPath } from 'url';

skills/webapp-testing/examples/console_logging.pyView file

•path = skills/webapp-testing/examples/console_logging.py kind = build_helper sizeBytes = 1043 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/webapp-testing/examples/console_logging.pyView on unpkg

Source & flagged code

3 flagged · loading source

dist/scripts/verify-build.jsView file

1import { execSync } from 'child_process'; L2: import fs from 'fs';

izanagi-ai@2.7.0

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code