registry / mandrel / 1.79.0

mandrel@1.79.0

Claude Code-first opinionated workflow framework: instructions, personas, skills, and SDLC workflows that govern AI coding assistants.

Static Scan Results

scanned 4d ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 14 file(s), 182 KB of source, external domains: cli.github.com, git-scm.com, github.com, nodejs.org, raw.githubusercontent.com

Source & flagged code

6 flagged

package.jsonView file

Lines 30-70json

30 "coverage:update": "node .agents/scripts/update-coverage-baseline.js",

31 "lint:md": "markdownlint-cli2 \".agents/**/*.md\" \"*.md\" \"!node_modules/**\" \"!.worktrees/**\"",

32 "lint": "node .agents/scripts/run-lint.js && npm run docs:check",

33 "docs:gen": "node .agents/scripts/generate-config-docs.js && node .agents/scripts/generate-lifecycle-docs.js && node .agents/scripts/generate-workflows-doc.js",

34 "docs:check": "node .agents/scripts/generate-config-docs.js --check && node .agents/scripts/generate-lifecycle-docs.js --check && node .agents/scripts/generate-workflows-doc.js --check && node .agents/scripts/check-lifecycle-doc-drift.js && node .agents/scripts/check-doc-links.js && node .agents/scripts/check-gherkin-placeholders.js && npm run skills:check",

35 "skills:index": "node .agents/scripts/generate-skills-index.js",

36 "skills:check": "node .agents/scripts/generate-skills-index.js --check",

37 "format": "biome format --write .",

38 "format:check": "biome ci .",

39 "maintainability:check": "node .agents/scripts/check-baselines.js --gate maintainability",

40 "maintainability:update": "node .agents/scripts/update-maintainability-baseline.js",

41 "check:arch": "node .agents/scripts/check-arch-cycles.js",

42 "crap:check": "node .agents/scripts/check-baselines.js --gate crap",

43 "crap:update": "node .agents/scripts/update-crap-baseline.js",

44 "duplication:check": "node .agents/scripts/check-baselines.js --gate duplication",

45 "duplication:update": "node .agents/scripts/update-duplication-baseline.js",

46 "quality:preview": "node .agents/scripts/quality-preview.js --changed-since HEAD && node .agents/scripts/check-dead-exports.js",

47 "quality:watch": "node .agents/scripts/quality-watch.js",

48 "sync:commands": "node bin/mandrel.js sync-commands",

49 "prepare": "husky && npm run sync:commands",

50 "postinstall": "node bin/postinstall.js mandrel sync"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L50

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L50

51 },

52 "repository": {

53 "type": "git",

54 "url": "git+https://github.com/dsj1984/mandrel.git"

55 },

56 "keywords": [

57 "claude-code",

58 "ai-agents",

59 "sdlc",

60 "workflow",

61 "orchestration",

62 "agentic"

63 ],

64 "author": "",

65 "license": "MIT",

66 "bin": {

67 "mandrel": "./bin/mandrel.js"

68 },

69 "type": "module",

70 "bugs": {

.agents/scripts/lib/qa/redact-evidence.jsView file

Lines 33-73javascript

33 * unchanged, so benign evidence is never mangled.

34 *

35 * Each placeholder is distinct per rule so a reader of the redacted evidence

36 * can still tell *what kind* of secret was scrubbed without seeing its value.

37 */

39/**

40 * Placeholder tokens substituted for each redacted span. Each is deliberately

bin/mandrel.jsView file

Lines 89-129javascript

89 },

90 ],

91 [

92 'uninstall',

93 {

94 description: 'reverse a recorded install using the install ledger',

95 knownFlags: new Set(['--include-github', '--dry-run']),

96 },

97 ],

.agents/skills/core/idea-refinement/scripts/idea-refine.shView file

•path = .agents/skills/core/idea-refinement/scripts/idea-refine.sh kind = payload_in_excluded_dir sizeBytes = 342 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.agents/skills/core/idea-refinement/scripts/idea-refine.shView on unpkg

•path = .agents/skills/core/idea-refinement/scripts/idea-refine.sh kind = build_helper sizeBytes = 342 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

.agents/skills/core/idea-refinement/scripts/idea-refine.shView on unpkg

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/postinstall.js mandrel sync

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node bin/postinstall.js mandrel sync

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

.agents/scripts/lib/qa/redact-evidence.jsView file

53patternName = generic_password severity = medium line = 53 matchedText = password...d]',

Medium

Secret Pattern

Package contains a possible secret pattern.

.agents/scripts/lib/qa/redact-evidence.jsView on unpkg · L53

bin/mandrel.jsView file

109function installedVersion() { L110: const req = createRequire(import.meta.url); L111: const manifest = req('../package.json');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/mandrel.jsView on unpkg · L109

.agents/skills/core/idea-refinement/scripts/idea-refine.shView file

•path = .agents/skills/core/idea-refinement/scripts/idea-refine.sh kind = payload_in_excluded_dir sizeBytes = 342 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.agents/skills/core/idea-refinement/scripts/idea-refine.shView on unpkg

•path = .agents/skills/core/idea-refinement/scripts/idea-refine.sh kind = build_helper sizeBytes = 342 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

.agents/skills/core/idea-refinement/scripts/idea-refine.shView on unpkg

Findings

2 High7 Medium5 Low

HighInstall Time Lifecycle Scriptspackage.json

HighPayload In Excluded Dir.agents/skills/core/idea-refinement/scripts/idea-refine.sh

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumSecret Pattern.agents/scripts/lib/qa/redact-evidence.js

MediumDynamic Requirebin/mandrel.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helper.agents/skills/core/idea-refinement/scripts/idea-refine.sh

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings