@foxxytux/buddy-coding-agent
17
Versions
—
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
gitHead linked
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
foxxytux
Keywords
general-agentagent-cliaillmclituiagent
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| semgrep | semgrep:steganography-image-eval | AI (semgrep): Flagged code reads a Doom WAD file in an examples/extensions directory — legitimate game engine example, not a steganography attack. | ai | |
| semgrep | semgrep:base64-decode | AI (semgrep): Base64 decode in examples/extensions/antigravity-image-gen.ts is standard image data handling, not payload delivery. | ai | |
| semgrep | semgrep:shady-links-raw-ip | AI (semgrep): 127.0.0.1:8080/callback is a localhost OAuth redirect URI — standard OAuth PKCE flow in a GitLab Duo extension example. | ai | |
| semgrep | semgrep:new-function-constructor | AI (semgrep): new Function() used to load a compiled Doom JS/WASM module in an examples/extensions file — legitimate emscripten module loading pattern. | ai | |
| semgrep | semgrep:child-process-import | AI (semgrep): child_process used for Windows toast notifications via powershell.exe in an examples/extensions/notify.ts file — benign notification utility. | ai | |
| provenance | no-provenance | AI (provenance): No provenance is common for this package; no other indicators of supply chain risk. | ai |