PkgRadar

npm · registry.npmjs.org

@mc-and-his-agents/loom

Credential file access: matched "GITHUB_TOKEN"

Why PkgRadar flagged 0.13.7

SeveritySignalEvidence
mediumCredential file accessmatched "GITHUB_TOKEN" · package/skills/loom-adopt/.loom-runtime/shared/scripts/loom_flow.py
mediumCredential file accessmatched "GITHUB_TOKEN" · package/skills/loom-build/.loom-runtime/shared/scripts/loom_flow.py
mediumCredential file accessmatched "GITHUB_TOKEN" · package/skills/loom-handoff/.loom-runtime/shared/scripts/loom_flow.py
mediumCredential file accessmatched "GITHUB_TOKEN" · package/skills/loom-init/.loom-runtime/shared/scripts/loom_flow.py
mediumCredential file accessmatched "GITHUB_TOKEN" · package/skills/loom-merge-ready/.loom-runtime/shared/scripts/loom_flow.py
mediumCredential file accessmatched "GITHUB_TOKEN" · package/skills/loom-pre-review/.loom-runtime/shared/scripts/loom_flow.py
mediumCredential file accessmatched "GITHUB_TOKEN" · package/skills/loom-resume/.loom-runtime/shared/scripts/loom_flow.py
mediumCredential file accessmatched "GITHUB_TOKEN" · package/skills/loom-retire/.loom-runtime/shared/scripts/loom_flow.py
mediumCredential file accessmatched "GITHUB_TOKEN" · package/skills/loom-review/.loom-runtime/shared/scripts/loom_flow.py
mediumCredential file accessmatched "GITHUB_TOKEN" · package/skills/loom-spec-review/.loom-runtime/shared/scripts/loom_flow.py
mediumCredential file accessmatched "GITHUB_TOKEN" · package/skills/loom-story/.loom-runtime/shared/scripts/loom_flow.py
mediumCredential file accessmatched "GITHUB_TOKEN" · package/skills/shared/scripts/loom_flow.py

Scanned versions

VersionVerdictScoreScanned (UTC)
0.13.10Low risk02026-06-03
0.13.9Low risk02026-06-02
0.13.8Low risk02026-06-02
0.13.7Review552026-05-27

Block this in CI

PkgRadar gates @mc-and-his-agents/loom (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem npm @mc-and-his-agents/[email protected]
Start free — 25 scans / moView full evidence