@kilocode/plugin
84%
Total Score
healthy
Active organization-backed project with frequent releases and commits, but workflow audit found extensive unpinned actions and high-confidence CI hygiene issues
Health Score Breakdown
Nine publishing accounts are listed, with six using the organization's kilocode.ai domain. The gmail.com accounts johndotawesome and rso, plus jlambert_anaconda at anaconda.com, are account-hygiene cautions, but organization backing provides continuity.
The audit found 98 of 109 action references unpinned, high-confidence template-injection findings, broad app-token and inherited-secret use, and an ad hoc package install; 8 of 38 workflows were not analyzed. No untrusted checkout was found, and the findings are workflow hygiene concerns rather than evidence that the package is unsafe.
Vulnerabilities
We didn't find any vulnerabilities for this package.
Package versions
Maintainers
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 zod Version 4.1.8 | — | — |
effect Version 4.0.0-beta.83 | — | — |
@kilocode/sdk Version 7.8.12 | — | — |
@ai-sdk/provider Version 3.0.8 | — | — |
Weekly Downloads
Info
- Last Published
- 17 hours ago
- Created
- 8 months ago
- Unpacked Size
- 0.1 MB
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.