registry / sdd-flow-kit / 1.6.7

sdd-flow-kit@1.6.7

⚠ Under review

Cross-agent SDD automated development workflow kit with PRD layered architecture, task splitting, context compression, and pending confirmations.

Static Scan Results

scanned 5h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 97.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystem

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 100 file(s), 786 KB of source

Source & flagged code

8 flagged

package.jsonView file

Lines 6-46json

6 "license": "MIT",

7 "engines": {

8 "node": ">=14.16.0"

9 },

10 "type": "commonjs",

11 "main": "dist/index.js",

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node dist/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node dist/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/core/agentRemediateInvoke.jsView file

9exports.agentRemediateHint = agentRemediateHint; L10: const child_process_1 = require("child_process"); L11: const path_1 = __importDefault(require("path"));

High

Child Process

Package source references child process execution.

dist/core/agentRemediateInvoke.jsView on unpkg · L9

•matchType = normalized_sha256 matchedPackage = sdd-flow-kit@1.3.13 matchedPath = dist/core/agentRemediateInvoke.js matchedIdentity = npm:c2RkLWZsb3cta2l0:1.3.13 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/core/agentRemediateInvoke.jsView on unpkg

dist/core/componentSubstance.jsView file

13*/ L14: const path_1 = __importDefault(require("path")); L15: const fs_1 = require("./fs");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/core/componentSubstance.jsView on unpkg · L13

dist/core/opsxDelivery.jsView file

187const openspecOk = hasCommand("openspec") || L188: (0, child_process_1.spawnSync)("npx", ["openspec", "--version"], { stdio: "ignore", cwd: root }).status === 0; L189: checks.push({

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/core/opsxDelivery.jsView on unpkg · L187

scripts/install-git-hooks.shView file

•path = scripts/install-git-hooks.sh kind = build_helper sizeBytes = 790 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/install-git-hooks.shView on unpkg

dist/core/playwrightEnsure.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = sdd-flow-kit@1.3.5 matchedIdentity = npm:c2RkLWZsb3cta2l0:1.3.5 similarity = 0.382 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/core/playwrightEnsure.jsView on unpkg

Findings

1 Critical4 High5 Medium4 Low

CriticalPrevious Version Dangerous Deltadist/core/playwrightEnsure.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/core/agentRemediateInvoke.js

HighRuntime Package Installdist/core/opsxDelivery.js

HighKnown Malware Source Similaritydist/core/agentRemediateInvoke.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requiredist/core/componentSubstance.js

MediumEnvironment Vars

MediumShips Build Helperscripts/install-git-hooks.sh

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

dist/core/agentRemediateInvoke.jsView file

Lines 1-29javascript

1"use strict";

2var __importDefault = (this && this.__importDefault) || function (mod) {

3 return (mod && mod.__esModule) ? mod : { "default": mod };

4};

5Object.defineProperty(exports, "__esModule", { value: true });

6exports.isRemediateAutorunEnabled = isRemediateAutorunEnabled;

7exports.resolveRemediateAgent = resolveRemediateAgent;

8exports.invokeAgentOpsxRemediate = invokeAgentOpsxRemediate;

9exports.agentRemediateHint = agentRemediateHint;

10const child_process_1 = require("child_process");

11const path_1 = __importDefault(require("path"));

High

Child Process

Package source references child process execution.

dist/core/agentRemediateInvoke.jsView on unpkg · L9

12const fs_1 = require("./fs");

13const opsxDelivery_1 = require("./opsxDelivery");

14const opsxDelivery_2 = require("./opsxDelivery");

15function hasCommand(cmd) {

16 return (0, child_process_1.spawnSync)("which", [cmd], { stdio: "ignore" }).status === 0;

17}

18const AGENT_LABEL = {

19 cursor: "Cursor",

20 "claude-code": "Claude Code",

21 codex: "Codex",

22 openclaw: "OpenClaw",

23 custom: "Custom Agent",

24};

25/** PRD 自动修复：默认允许已选 agent 自动执行（可用环境变量关闭） */

26function isRemediateAutorunEnabled(agent) {

27 if (process.env.SDD_FLOW_KIT_ENABLE_AGENT_AUTORUN === "0")

28 return false;

29 switch (agent) {

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/core/agentRemediateInvoke.jsView on unpkg

dist/core/componentSubstance.jsView file

Lines 1-33javascript

1"use strict";

2var __importDefault = (this && this.__importDefault) || function (mod) {

3 return (mod && mod.__esModule) ? mod : { "default": mod };

4};

5Object.defineProperty(exports, "__esModule", { value: true });

6exports.countEffectiveLines = countEffectiveLines;

7exports.signalPresentInComponent = signalPresentInComponent;

8exports.analyzeComponentSubstance = analyzeComponentSubstance;

9exports.checkChildComponentsImported = checkChildComponentsImported;

10exports.checkComponentSubstance = checkComponentSubstance;

11/**

12 * 组件实质门禁：防止演示迁移用空壳 .vue/.tsx + 注释塞关键词过关。

13 */

14const path_1 = __importDefault(require("path"));

15const fs_1 = require("./fs");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/core/componentSubstance.jsView on unpkg · L13

16const testAssertionAnalysis_1 = require("./testAssertionAnalysis");

17const MIN_EFFECTIVE_LINES = 40;

18const VUE_TEMPLATE_RE = /<template[^>]*>([\s\S]*?)<\/template>/i;

21const EMIT_HANDLER_RE = /defineEmits|emit\s*\(|@\w+\s*=\s*["']|onClick|onSubmit/i;

22/** 子组件路径启发式（Section/Modal 等须被父组件引用） */

23const CHILD_COMPONENT_RE = /(?:Section|Modal|Panel|Form)\.vue$/i;

24const PARENT_CONTAINER_RE = /(?:Drawer|index)\.vue$/i;

25/**

26 * 统计去注释后的非空行数，用于识别空壳文件。

27 */

28function countEffectiveLines(content) {

29 const stripped = (0, testAssertionAnalysis_1.stripComments)(content);

30 return stripped.split("\n").filter((l) => l.trim().length > 0).length;

31}

32/**

33 * 交互信号须出现在 template 或 script（非注释），禁止只在注释中登记。

dist/core/opsxDelivery.jsView file

Lines 167-207javascript

167 repairedScripts,

168 checks,

169 plannedActions,

170 };

171}

172async function collectDeliverySetupChecks(installRoot) {

173 var _a, _b, _c, _d, _e, _f, _g;

174 const checks = [];

175 const root = typeof installRoot === 'string' ? installRoot : await installRoot;

176 const openspecRoot = await (0, projectRoots_1.resolveOpenspecRoot)(root);

177 checks.push({

178 name: "install-root",

179 ok: true,

180 detail: `安装根=${root}`,

181 });

182 checks.push({

183 name: "openspec-dir",

184 ok: await pathExists(path_1.default.join(openspecRoot, "openspec")),

185 detail: openspecRoot === root ? "openspec/ 目录（安装根）" : `openspec/ 目录（上级 ${openspecRoot}）`,

186 });

187 const openspecOk = hasCommand("openspec") ||

188 (0, child_process_1.spawnSync)("npx", ["openspec", "--version"], { stdio: "ignore", cwd: root }).status === 0;

189 checks.push({

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/core/opsxDelivery.jsView on unpkg · L187

190 name: "openspec-cli",

191 ok: openspecOk,

192 detail: openspecOk ? "openspec CLI 可用" : "请安装 openspec CLI 或执行 opsx-workflow setup",

193 });

194 const skillPath = path_1.default.join(root, ".cursor", "skills", "opsx-dev-delivery-pipeline", "SKILL.md");

195 checks.push({

196 name: "opsx-dev-delivery-pipeline-skill",

197 ok: await pathExists(skillPath),

198 detail: skillPath,

199 });

200 const tddPath = path_1.default.join(root, ".cursor", "skills", "tdd-script", "SKILL.md");

201 checks.push({

202 name: "tdd-script-skill",

203 ok: await pathExists(tddPath),

204 detail: tddPath,

205 });

206 const applyPath = path_1.default.join(root, ".cursor", "skills", "openspec-apply-change", "SKILL.md");

207 checks.push({