swe-pro-agents@2.8.0: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

swe-pro-agents@2.8.0: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/install.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/swe-pro-agents.jsView file

20L21: const fs = require('fs'); L22: const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/swe-pro-agents.jsView on unpkg · L20

scripts/install.jsView file

5* skill files to ~/.config/opencode/skills/, plugin files to L6: * ~/.config/opencode/plugins/, and this pack's AGENTS.md (the L7: * shared foundation every lean agent file in agents/ depends on ... L11: * L12: * AGENTS.md must NEVER be placed inside the agents directory: L13: * OpenCode loads every .md file in a registered agents path as L14: * an agent profile, so an AGENTS.md there shows up as a phantom L15: * "AGENTS" agent. The pack's copy lives outside that path and L16: * the user is told to copy/merge it into their global L17: * ~/.config/opencode/AGENTS.md. L18: * ... L31: *

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/install.jsView on unpkg · L5

skills/svg-hero-generator/scripts/repo_signals.pyView file

•path = skills/svg-hero-generator/scripts/repo_signals.py kind = build_helper sizeBytes = 2096 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/svg-hero-generator/scripts/repo_signals.pyView on unpkg

skills/high-quality-flowcharts/templates/cpp.pdfView file

•path = skills/high-quality-flowcharts/templates/cpp.pdf kind = high_entropy_blob sizeBytes = 236675 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

skills/high-quality-flowcharts/templates/cpp.pdfView on unpkg

Source & flagged code

6 flagged

package.jsonView file

Lines 23-53json

23 "repository": {

24 "type": "git",

25 "url": "git+https://github.com/beast-ofcourse/SWE-pro-Agents.git"

26 },

27 "files": [

28 "agents/",

29 "skills/",

30 "scripts/",

31 "plugins/",

32 "bin/",

33 "test/",

34 "assets/",

35 "AGENTS.md",

36 "README.md",

37 "LICENSE"

38 ],

39 "bin": {

40 "swe-pro-agents": "bin/swe-pro-agents.js"

41 },

42 "scripts": {

43 "postinstall": "node scripts/install.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L43

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L43

44 "preuninstall": "node scripts/uninstall.js",

45 "test": "node test/installer.test.js && node test/validate.test.js && node test/validate-plan.test.js && node test/loop-logic.test.js && node test/run-loop.test.js && node test/bin.test.js && node test/continuation.test.js",

46 "validate": "node scripts/validate.js",

47 "validate:plan": "node scripts/validate-plan.js"

48 },

49 "engines": {

50 "node": ">=18"

51 }

52}

53

bin/swe-pro-agents.jsView file

Lines 1-40javascript

1#!/usr/bin/env node

2

3/**

4 * CLI for SWE Pro Agents.

5 *

6 * Commands:

7 * swe-pro-agents run [result] [--plan <dir>] [--dry-run]

8 * [--max-iterations <n>] [--no-continue] [--json]

9 * — Drive the plan-execution loop (see cmdRun below).

10 * swe-pro-agents setup [--apply] — Show the opencode.json config snippet

11 * (--apply writes it, with a .bak backup)

scripts/install.jsView file

Lines 1-25javascript

1#!/usr/bin/env node

2

3/**

4 * postinstall — copies agent files to ~/.config/opencode/agents/swe-pro-agents/,

5 * skill files to ~/.config/opencode/skills/, plugin files to

6 * ~/.config/opencode/plugins/, and this pack's AGENTS.md (the

7 * shared foundation every lean agent file in agents/ depends on

8 * — Core priorities, Engineering rules, Completion checklist,

9 * Reporting format) to the pack's own config dir

10 * (~/.config/swe-pro-agents/).

skills/svg-hero-generator/scripts/repo_signals.pyView file

•path = skills/svg-hero-generator/scripts/repo_signals.py kind = build_helper sizeBytes = 2096 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/svg-hero-generator/scripts/repo_signals.pyView on unpkg

skills/high-quality-flowcharts/templates/cpp.pdfView file

•path = skills/high-quality-flowcharts/templates/cpp.pdf kind = high_entropy_blob sizeBytes = 236675 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

skills/high-quality-flowcharts/templates/cpp.pdfView on unpkg