registry / mandrel / 2.0.0

mandrel@2.0.0

Claude Code-first opinionated workflow framework: instructions, skills, rules, and SDLC workflows that govern AI coding assistants.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 15 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 14 file(s), 188 KB of source, external domains: cli.github.com, git-scm.com, github.com, nodejs.org, raw.githubusercontent.com

Source & flagged code

7 flagged

package.jsonView file

Lines 33-73json

33 "lint": "node .agents/scripts/run-lint.js && npm run docs:check",

34 "docs:gen": "node .agents/scripts/generate-config-docs.js && node .agents/scripts/generate-lifecycle-docs.js && node .agents/scripts/generate-workflows-doc.js && node .agents/scripts/generate-lens-checklists.js",

35 "docs:check": "node .agents/scripts/generate-config-docs.js --check && node .agents/scripts/generate-lifecycle-docs.js --check && node .agents/scripts/generate-workflows-doc.js --check && node .agents/scripts/generate-lens-checklists.js --check && node .agents/scripts/check-lifecycle-doc-drift.js && node .agents/scripts/check-doc-links.js && node .agents/scripts/check-gherkin-placeholders.js && npm run skills:check",

36 "skills:index": "node .agents/scripts/generate-skills-index.js",

37 "skills:check": "node .agents/scripts/generate-skills-index.js --check",

38 "format": "biome format --write .",

39 "format:check": "biome ci .",

40 "maintainability:check": "node .agents/scripts/check-baselines.js --gate maintainability",

41 "maintainability:update": "node .agents/scripts/update-maintainability-baseline.js",

42 "check:arch": "node .agents/scripts/check-arch-cycles.js",

43 "check:context-budget": "node .agents/scripts/check-context-budget.js",

44 "crap:check": "node .agents/scripts/check-baselines.js --gate crap",

45 "crap:update": "node .agents/scripts/update-crap-baseline.js",

46 "duplication:check": "node .agents/scripts/check-baselines.js --gate duplication",

47 "duplication:update": "node .agents/scripts/update-duplication-baseline.js",

48 "quality:preview": "node .agents/scripts/quality-preview.js --changed-since HEAD && node .agents/scripts/check-dead-exports.js",

49 "quality:watch": "node .agents/scripts/quality-watch.js",

50 "sync:commands": "node bin/mandrel.js sync-commands",

51 "sync:agents": "node .agents/scripts/sync-claude-agents.js",

52 "prepare": "husky && npm run sync:commands && npm run sync:agents",

53 "postinstall": "node bin/postinstall.js mandrel sync"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L53

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L53

54 },

55 "repository": {

56 "type": "git",

57 "url": "git+https://github.com/dsj1984/mandrel.git"

58 },

59 "keywords": [

60 "claude-code",

61 "ai-agents",

62 "sdlc",

63 "workflow",

64 "orchestration",

65 "agentic"

66 ],

67 "author": "",

68 "license": "MIT",

69 "bin": {

70 "mandrel": "./bin/mandrel.js"

71 },

72 "type": "module",

73 "bugs": {

.agents/scripts/lib/qa/redact-evidence.jsView file

Lines 33-73javascript

33 * unchanged, so benign evidence is never mangled.

34 *

35 * Each placeholder is distinct per rule so a reader of the redacted evidence

36 * can still tell *what kind* of secret was scrubbed without seeing its value.

37 */

39/**

40 * Placeholder tokens substituted for each redacted span. Each is deliberately

bin/mandrel.jsView file

Lines 89-129javascript

89 },

90 ],

91 [

92 'uninstall',

93 {

94 description: 'reverse a recorded install using the install ledger',

95 knownFlags: new Set(['--include-github', '--dry-run']),

96 },

97 ],

.agents/skills/core/idea-refinement/scripts/idea-refine.shView file

•path = .agents/skills/core/idea-refinement/scripts/idea-refine.sh kind = payload_in_excluded_dir sizeBytes = 342 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.agents/skills/core/idea-refinement/scripts/idea-refine.shView on unpkg

•path = .agents/skills/core/idea-refinement/scripts/idea-refine.sh kind = build_helper sizeBytes = 342 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

.agents/skills/core/idea-refinement/scripts/idea-refine.shView on unpkg

lib/cli/registry.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = mandrel@1.93.0 matchedIdentity = npm:bWFuZHJlbA:1.93.0 similarity = 0.929 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/cli/registry.jsView on unpkg

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/postinstall.js mandrel sync

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node bin/postinstall.js mandrel sync

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

.agents/scripts/lib/qa/redact-evidence.jsView file

53patternName = generic_password severity = medium line = 53 matchedText = password...d]',

Medium

Secret Pattern

Package contains a possible secret pattern.

.agents/scripts/lib/qa/redact-evidence.jsView on unpkg · L53

bin/mandrel.jsView file

109function installedVersion() { L110: const req = createRequire(import.meta.url); L111: const manifest = req('../package.json');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/mandrel.jsView on unpkg · L109

.agents/skills/core/idea-refinement/scripts/idea-refine.shView file

•path = .agents/skills/core/idea-refinement/scripts/idea-refine.sh kind = payload_in_excluded_dir sizeBytes = 342 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.agents/skills/core/idea-refinement/scripts/idea-refine.shView on unpkg

•path = .agents/skills/core/idea-refinement/scripts/idea-refine.sh kind = build_helper sizeBytes = 342 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

.agents/skills/core/idea-refinement/scripts/idea-refine.shView on unpkg

lib/cli/registry.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/cli/registry.jsView on unpkg

Findings

3 High7 Medium5 Low

HighInstall Time Lifecycle Scriptspackage.json

HighPayload In Excluded Dir.agents/skills/core/idea-refinement/scripts/idea-refine.sh

HighPrevious Version Dangerous Deltalib/cli/registry.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumSecret Pattern.agents/scripts/lib/qa/redact-evidence.js

MediumDynamic Requirebin/mandrel.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helper.agents/skills/core/idea-refinement/scripts/idea-refine.sh

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings