swe-pro-agents@2.4.0: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

swe-pro-agents@2.4.0: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/install.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/swe-pro-agents.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = swe-pro-agents@2.2.0 matchedIdentity = npm:c3dlLXByby1hZ2VudHM:2.2.0 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/swe-pro-agents.jsView on unpkg

13L14: const fs = require('fs'); L15: const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/swe-pro-agents.jsView on unpkg · L13

scripts/install.jsView file

5* skill files to ~/.config/opencode/skills/, and this pack's L6: * AGENTS.md (the shared foundation every lean agent file in L7: * agents/ depends on — Core priorities, Engineering rules, ... L22: * L23: * User still needs to add the agent path to their opencode.json, and merge in L24: * (or point OpenCode at) the shipped AGENTS.md once. `swe-pro-agents setup` L25: * prints the config snippet; `swe-pro-agents setup --apply` writes it. ... L27: * L28: * IMPORTANT: this pack's AGENTS.md is never written directly to L29: * ~/.config/opencode/AGENTS.md or a project's AGENTS.md — that file may L30: * already exist with the user's own project rules, and silently overwriting ... L41: const SKILLS_DIR = path.join(os.homedir(), '.config', 'opencode',

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/install.jsView on unpkg · L5

skills/svg-hero-generator/scripts/repo_signals.pyView file

•path = skills/svg-hero-generator/scripts/repo_signals.py kind = build_helper sizeBytes = 2096 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/svg-hero-generator/scripts/repo_signals.pyView on unpkg

skills/high-quality-flowcharts/templates/cpp.pdfView file

•path = skills/high-quality-flowcharts/templates/cpp.pdf kind = high_entropy_blob sizeBytes = 236675 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

skills/high-quality-flowcharts/templates/cpp.pdfView on unpkg

Source & flagged code

7 flagged

package.jsonView file

Lines 21-50json

21 "license": "MIT",

22 "author": "beast-ofcourse",

23 "repository": {

24 "type": "git",

25 "url": "git+https://github.com/beast-ofcourse/SWE-pro-Agents.git"

26 },

27 "files": [

28 "agents/",

29 "skills/",

30 "scripts/",

31 "bin/",

32 "assets/",

33 "AGENTS.md",

34 "README.md",

35 "LICENSE"

36 ],

37 "bin": {

38 "swe-pro-agents": "bin/swe-pro-agents.js"

39 },

40 "scripts": {

41 "postinstall": "node scripts/install.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L41

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L41

42 "preuninstall": "node scripts/uninstall.js",

43 "test": "node test/installer.test.js && node test/validate.test.js",

44 "validate": "node scripts/validate.js"

45 },

46 "engines": {

47 "node": ">=18"

48 }

49}

50

bin/swe-pro-agents.jsView file

Lines 1-33javascript

1#!/usr/bin/env node

2

3/**

4 * CLI for managing SWE Pro Agents installation.

5 *

6 * Usage:

7 * swe-pro-agents setup [--apply] — Show the opencode.json config snippet

8 * (--apply writes it, with a .bak backup)

9 * swe-pro-agents status — Show installation status + update check

10 * swe-pro-agents version — Show version

11 * swe-pro-agents help — Show this help

scripts/install.jsView file

Lines 1-25javascript

1#!/usr/bin/env node

2

3/**

4 * postinstall — copies agent files to ~/.config/opencode/agents/swe-pro-agents/,

5 * skill files to ~/.config/opencode/skills/, and this pack's

6 * AGENTS.md (the shared foundation every lean agent file in

7 * agents/ depends on — Core priorities, Engineering rules,

8 * Completion checklist, Reporting format) to a package-scoped

9 * location.

10 *

11 * Runs automatically after `npm install -g swe-pro-agents`.

skills/svg-hero-generator/scripts/repo_signals.pyView file

•path = skills/svg-hero-generator/scripts/repo_signals.py kind = build_helper sizeBytes = 2096 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/svg-hero-generator/scripts/repo_signals.pyView on unpkg

skills/high-quality-flowcharts/templates/cpp.pdfView file

•path = skills/high-quality-flowcharts/templates/cpp.pdf kind = high_entropy_blob sizeBytes = 236675 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

skills/high-quality-flowcharts/templates/cpp.pdfView on unpkg