Loading npm security reports…
내 일을 대신해주는 막둥이들. Self-contained opencode plugin for 사내 workflow: per-stage specialist agents, deterministic shell gates, primary-only enforcement, and a model fallback advisor.
Static analysis flagged 14 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Package defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgPackage source invokes a package manager install command at runtime.
bin/cli.jsView on unpkg · L3Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
scripts/install-lib.mjsView on unpkg · L9Package ships non-JavaScript build or shell helper files.
gates/stage6-post-commit-verify.shView on unpkgPackage defines install-time lifecycle scripts.
package.jsonView on unpkg · L70Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg · L70Package ships non-JavaScript build or shell helper files.
gates/stage6-post-commit-verify.shView on unpkgPackage source invokes a package manager install command at runtime.
bin/cli.jsView on unpkg · L3Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
scripts/install-lib.mjsView on unpkg · L9