registry / rfc2119 / 0.6.0

rfc2119@0.6.0

Spec-driven test enforcement for coding agents: RFC 2119 requirements docs, requirement-to-test traceability, and judgment reviews that are hard to cheat.

AI Security Review

scanned 1d ago · by lpm-firewall-ai

No confirmed malicious attack surface. Explicit setup commands can create repository-local agent hooks and validation artifacts for the package’s stated workflow.

Static reason

No blocking static signals were detected.

Trigger

User runs `2119 init` with optional flags or invokes its configured hook/check commands.

Impact

May modify the current project’s configuration, hooks, CI, and review files; no install-time mutation, stealth persistence, or exfiltration was found.

Mechanism

User-invoked repository scaffolding, agent-hook integration, and local requirement validation.

Rationale

The package has explicit user-commanded agent integration and can run user-authored `[verify]` commands as part of its validation feature, but it has no install-time execution or concrete malicious chain. The only network use is a bounded package-version update probe.

Evidence

package.jsondist/cli.jsdist/init.jsdist/adapters.jsdist/hook.jsdist/verify.js.2119.ymlspecs/REQ-001-example.md.gitignoreAGENTS.mdCLAUDE.md.claude/settings.json.claude/agents/2119-reviewer.md.codex/hooks.json.gemini/settings.json.git/hooks/pre-commit.github/workflows/2119.yml~/.cache/2119/upgrade.json

rfc2119@0.6.0

AI Security Review

Decision evidence

Source & flagged code

Findings