Results are bound to the listed commit and cover only static checks run by this registry. The Evidence Score measures reviewable information; it is not a compatibility percentage or a security guarantee.

Static repository check

Sep 8, 2026, 9:21 AM

High risk

Checked commit: 2bcabb2405da
Evidence Score: 72/100
Static risk: High risk
Files scanned: 28
Findings: 10

Evidence breakdown

Source provenance22/25

Install documentation15/25

Maintenance18/20

Compatibility evidence14/20

Security signals3/10

Compatibility confidence: Limited

Install-time scripts (6)

website/package.json#preparenpm run validate:locales && npm run prepare:docs && npm run generate:changelog && npm run generate:agents && npm run validate:agent-index
src/copilot-shell/package.json#prepare(cd ../.. && husky src/copilot-shell/.husky) && npm run build && npm run bundle
src/anolisa/npm/package.json#postinstallnode scripts/postinstall.js
src/tokenless/npm/package.json#postinstallnode scripts/postinstall.js
src/agentsight/dsh-plugin/package.json#preparetsc
src/copilot-shell/packages/core/package.json#postinstallnode scripts/postinstall.js

Findings (10)

Highinstall.script
src/agentsight/dsh-plugin/package.jsoninstall-time
```
"prepare": "tsc"
```
Highinstall.script
src/anolisa/npm/package.jsoninstall-time
```
"postinstall": "node scripts/postinstall.js"
```

Highinstall.script

src/copilot-shell/package.jsoninstall-time

"prepare": "(cd ../.. && husky src/copilot-shell/.husky) && npm run build && npm run bundle"

Highinstall.script
src/copilot-shell/packages/core/package.jsoninstall-time
```
"postinstall": "node scripts/postinstall.js"
```
Highinstall.script
src/tokenless/npm/package.jsoninstall-time
```
"postinstall": "node scripts/postinstall.js"
```

Highinstall.script

website/package.jsoninstall-time

"prepare": "npm run validate:locales && npm run prepare:docs && npm run generate:changelog && npm run generate:agents && npm run validate:agent-index"

Mediumobfuscation.child-process
src/copilot-shell/packages/core/scripts/postinstall.js:9obfuscation
```
import { execSync } from 'node:child_process';
```
Mediumobfuscation.child-process
src/copilot-shell/packages/core/scripts/postinstall.js:70obfuscation
```
execSync(`xattr -d com.apple.quarantine "${rgBinary}"`, {
```
Mediumobfuscation.child-process
src/tokenless/npm/scripts/postinstall.js:38obfuscation
```
import { execSync } from 'node:child_process';
```
Mediumobfuscation.child-process
src/tokenless/npm/scripts/postinstall.js:88obfuscation
```
const out = execSync('ldd --version 2>&1 || true', {
```

Not run

Dependency advisory database scan
Installation execution test
Runtime behavior verification

Scanner 1.0.0 · Scorer 1.0.0

anolisa

Plugins in this repository

Overview

Repository check result

Static repository check

Evidence breakdown