registry / takomi / 2.1.39

takomi@2.1.39

🎯 Stop wrestling with AI. Start building with purpose. The artisan's toolkit for agent workflows, Codex skills, and original Takomi capabilities like 21st.dev integration.

Static Scan Results

scanned 6d ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 58 file(s), 366 KB of source, external domains: 127.0.0.1, api.github.com, github.com, labs.google, raw.githubusercontent.com, registry.npmjs.org

Source & flagged code

6 flagged

package.jsonView file

Lines 19-59json

19 "plugins/takomi-flow/assets",

20 "plugins/takomi-flow/package.json",

21 "plugins/takomi-flow/pnpm-lock.yaml",

22 "plugins/takomi-flow/references",

23 "plugins/takomi-flow/scripts",

24 "plugins/takomi-flow/skills",

25 ".agents/plugins/marketplace.json",

26 "scripts/install-takomi-flow.ps1",

27 ".pi/README.md",

28 ".pi/agents",

29 ".pi/extensions",

30 ".pi/prompts",

31 ".pi/themes",

32 ".pi/settings.json",

33 ".pi/takomi-profile.json",

34 ".pi/takomi/context-manager",

35 ".pi/takomi/model-routing.md",

36 ".pi/takomi/policies"

37 ],

38 "scripts": {

39 "postinstall": "node src/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L39

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L39

40 "test": "npm run test:typecheck && npm run test:regressions && npm run test:skills",

41 "test:typecheck": "tsc --noEmit",

42 "test:regressions": "node scripts/test-regressions.js",

43 "test:skills": "node scripts/test-skill-selection.js",

44 "takomi-flow:doctor": "node plugins/takomi-flow/scripts/takomi-flow.mjs doctor",

45 "takomi-flow:selftest": "node plugins/takomi-flow/scripts/takomi-flow.mjs selftest",

46 "takomi-flow:mcp-smoke": "node plugins/takomi-flow/scripts/mcp-smoke.mjs"

47 },

48 "repository": {

49 "type": "git",

50 "url": "git+https://github.com/JStaRFilms/VibeCode-Protocol-Suite.git"

51 },

52 "keywords": [

53 "takomi",

54 "ai",

55 "skills",

56 "codex",

57 "agentic",

58 "21st.dev",

59 "vibecode",

assets/Takomi-Agents/kilo-code-settings.jsonView file

Lines 1-1json

1{"providerProfiles":{"currentApiConfigName":"default","apiConfigs":{"default":{"diffEnabled":true,"fuzzyMatchThreshold":1,"kilocodeToken":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJlbnYiOiJwcm9kdWN0aW9uIiwia2lsb1VzZXJJZCI6Im9hdXRoL2dvb2dsZToxMTQ4Mjg3ODA4MzMyOTc1ODA1MDYiLCJhcGlUb2tlblBlcHBlciI6bnVsbCwidmVyc2lvbiI6MywiZGV2aWNlQXV0aFJlcXVlc3RDb2RlIjoiMlVHWS0yVldCIiwiaWF0IjoxNzY5OTg0Mzg2LCJleHAiOjE5Mjc3NzIzODZ9.J6ugFyjB9uu-_zteCisSXwK-6HQ1rvYshCzhD1Yvrdc","kilocodeModel":"minimax/minimax-m2.1:free","openRouterSpecificProvider":"[default]","apiProvider":

plugins/takomi-codex/scripts/takomi-pi-dispatch.ps1View file

•path = plugins/takomi-codex/scripts/takomi-pi-dispatch.ps1 kind = build_helper sizeBytes = 2668 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

plugins/takomi-codex/scripts/takomi-pi-dispatch.ps1View on unpkg

assets/.agent/skills/ui-ux-pro-max/scripts/design_system.pyView file

•path = assets/.agent/skills/ui-ux-pro-max/scripts/design_system.py kind = payload_in_excluded_dir sizeBytes = 44681 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

assets/.agent/skills/ui-ux-pro-max/scripts/design_system.pyView on unpkg

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node src/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node src/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

assets/Takomi-Agents/kilo-code-settings.jsonView file

1patternName = supabase_service_key severity = critical line = 1 matchedText = {"provid...l"}}

Critical

Critical Secret

Package contains a critical-looking secret pattern.

assets/Takomi-Agents/kilo-code-settings.jsonView on unpkg · L1

1patternName = supabase_service_key severity = critical line = 1 matchedText = {"provid...l"}}

Critical

Secret Pattern

Supabase service role key (JWT) in assets/Takomi-Agents/kilo-code-settings.json

assets/Takomi-Agents/kilo-code-settings.jsonView on unpkg · L1

plugins/takomi-codex/scripts/takomi-pi-dispatch.ps1View file

•path = plugins/takomi-codex/scripts/takomi-pi-dispatch.ps1 kind = build_helper sizeBytes = 2668 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

plugins/takomi-codex/scripts/takomi-pi-dispatch.ps1View on unpkg

assets/.agent/skills/ui-ux-pro-max/scripts/design_system.pyView file

•path = assets/.agent/skills/ui-ux-pro-max/scripts/design_system.py kind = payload_in_excluded_dir sizeBytes = 44681 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

assets/.agent/skills/ui-ux-pro-max/scripts/design_system.pyView on unpkg

Findings

2 Critical2 High5 Medium4 Low

CriticalCritical Secretassets/Takomi-Agents/kilo-code-settings.json

CriticalSecret Patternassets/Takomi-Agents/kilo-code-settings.json

HighInstall Time Lifecycle Scriptspackage.json

HighPayload In Excluded Dirassets/.agent/skills/ui-ux-pro-max/scripts/design_system.py

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperplugins/takomi-codex/scripts/takomi-pi-dispatch.ps1

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

6 flagged

package.jsonView file

Lines 19-59json

19 "plugins/takomi-flow/assets",

20 "plugins/takomi-flow/package.json",

21 "plugins/takomi-flow/pnpm-lock.yaml",

22 "plugins/takomi-flow/references",

23 "plugins/takomi-flow/scripts",

24 "plugins/takomi-flow/skills",

25 ".agents/plugins/marketplace.json",

26 "scripts/install-takomi-flow.ps1",

27 ".pi/README.md",

28 ".pi/agents",

29 ".pi/extensions",

30 ".pi/prompts",

31 ".pi/themes",

32 ".pi/settings.json",

33 ".pi/takomi-profile.json",

34 ".pi/takomi/context-manager",

35 ".pi/takomi/model-routing.md",

36 ".pi/takomi/policies"

37 ],

38 "scripts": {

39 "postinstall": "node src/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L39

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L39

40 "test": "npm run test:typecheck && npm run test:regressions && npm run test:skills",

41 "test:typecheck": "tsc --noEmit",

42 "test:regressions": "node scripts/test-regressions.js",

43 "test:skills": "node scripts/test-skill-selection.js",

44 "takomi-flow:doctor": "node plugins/takomi-flow/scripts/takomi-flow.mjs doctor",

45 "takomi-flow:selftest": "node plugins/takomi-flow/scripts/takomi-flow.mjs selftest",

46 "takomi-flow:mcp-smoke": "node plugins/takomi-flow/scripts/mcp-smoke.mjs"

47 },

48 "repository": {

49 "type": "git",

50 "url": "git+https://github.com/JStaRFilms/VibeCode-Protocol-Suite.git"

51 },

52 "keywords": [

53 "takomi",

54 "ai",

55 "skills",

56 "codex",

57 "agentic",

58 "21st.dev",

59 "vibecode",

assets/Takomi-Agents/kilo-code-settings.jsonView file

Lines 1-1json

plugins/takomi-codex/scripts/takomi-pi-dispatch.ps1View file

•path = plugins/takomi-codex/scripts/takomi-pi-dispatch.ps1 kind = build_helper sizeBytes = 2668 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

plugins/takomi-codex/scripts/takomi-pi-dispatch.ps1View on unpkg

assets/.agent/skills/ui-ux-pro-max/scripts/design_system.pyView file

•path = assets/.agent/skills/ui-ux-pro-max/scripts/design_system.py kind = payload_in_excluded_dir sizeBytes = 44681 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

assets/.agent/skills/ui-ux-pro-max/scripts/design_system.pyView on unpkg