npm JavaScript analyzed 0.1.461

@vpxa/aikit

v0.1.461

Local-first AI developer toolkit — knowledge base, code analysis, context management, and developer tools for LLM agents

Drift inferred · capture-to-capture

capabilities 0 tools

transport stdio · streamable-http · http counts 0 tools · 0 res · 0 prompts permission surface via code analysis

No tools enumerated yet for this server.

skills & danger signals npm-tarball

prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed v0.1.461 · analyzer v28 · 1h ago

dynamic code execution new Function() package/scaffold/dist/definitions/bodies.mjs :497 - [ ] **eval/Function prevention**: No dynamic code execution from user input (\`eval()\`, \`new Function()\`, \`vm.runInNewContext()\`)
dynamic code execution vm exec package/scaffold/dist/definitions/bodies.mjs :497 - [ ] **eval/Function prevention**: No dynamic code execution from user input (\`eval()\`, \`new Function()\`, \`vm.runInNewContext()\`)
dynamic code execution eval() package/scaffold/dist/definitions/bodies.mjs :497 - [ ] **eval/Function prevention**: No dynamic code execution from user input (\`eval()\`, \`new Function()\`, \`vm.runInNewContext()\`)
dynamic code execution new Function() package/scaffold/dist/definitions/skills/typescript.mjs :353 - Avoid \`eval()\`, \`new Function()\`, and dynamic \`require()\`.
dynamic code execution eval() package/scaffold/dist/definitions/skills/typescript.mjs :353 - Avoid \`eval()\`, \`new Function()\`, and dynamic \`require()\`.

code evidence v0.1.461 · npm-tarball

evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 136

fs package/bin/aikit.mjs :2 import { existsSync, readFileSync } from 'node:fs';
fs package/bin/postinstall-managed-launcher.mjs :15 import { existsSync } from 'node:fs';
fs package/packages/claude-desktop/dist/light/server/index.mjs :13 import { existsSync, readFileSync } from 'node:fs';
fs package/scaffold/dist/definitions/skills/_shared-viewer-inject.mjs :2 import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
fs package/scaffold/dist/definitions/skills/adr-skill.mjs :480 const fs=require('node:fs');

shell package/packages/claude-desktop/dist/light/server/index.mjs :12 import { spawn } from 'node:child_process';
shell package/packages/server/dist/proxy.js :2 import{n as e}from"./auth-WyW7VMsN.js";import{fileURLToPath as t}from"node:url";import{spawn as n}from"node:child_process";import{homedir as r}from"node:os";import{createInterface as i}from"node:readl
shell package/scaffold/dist/adapters/skills.mjs :1 import{execSync as e}from"node:child_process";import{existsSync as t,readFileSync as n,statSync as r}from"node:fs";import{dirname as i,join as a,resolve as o}from"node:path";import{fileURLToPath as s}

net package/packages/browser/dist/index.js :7 })`:`fetch(${JSON.stringify(e)}, ${o}).then(async r => {
net package/packages/server/dist/browser-Nf8JA_qi.js :136 await fetch(READY_URL, {
net package/scaffold/dist/definitions/skills/browser-use.mjs :286 Step 4: Replay with fetch (using page session)
net package/scaffold/dist/definitions/skills/typescript.mjs :325 try { return await fetch(url, { signal: controller.signal }); }

db package/scaffold/dist/definitions/skills/adr-skill.mjs :306 - [ ] \`grep -r "from 'pg'" src/ --include='*.ts' | grep -v 'src/db/'\` returns no results

postinstall package/package.json :133 node ./bin/postinstall-managed-launcher.mjs
postinstall package/packages/chunker/package.json :19 node scripts/vendor-wasm.mjs || echo WASM vendoring skipped (deps not available)