@sanity/ailf
AI Literacy Framework - Evaluation tool for Sanity documentation
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | publisher-changed | AI (provenance): Transition from individual (gabe.wyatt) to org account (sanity-io) within @sanity scope; legitimate org consolidation. | ai | |
| maintainer-change | maintainer-removed | AI (maintainer-change): Org-level maintainer consolidation under sanity-io org account; not a takeover signal. | ai | |
| source-diff | obfuscated-file:dist/_vendor/ailf-shared/generated/help-content.js | AI (source-diff): Auto-generated help content with long lines from embedded markdown; not obfuscated code. | ai | |
| source-diff | net-exec-file:dist/agent-harness/assertions-runtime.js | AI (source-diff): Documented promptfoo assertion helper for test harness; execSync runs developer-authored task definitions, not remote code. | ai | |
| source-diff | net-exec-file:dist/agent-harness/assertions-runtime.d.ts | AI (source-diff): Type declaration file for the same assertion helper; no executable payload. | ai | |
| provenance | missing-githead | AI (provenance): Sanity-org package with clean diff and strong publisher history; gitHead absence is a CI config change, not a supply-chain indicator. | ai | |
| dependencies | unvetted-dep:@portabletext/markdown | AI (dependencies): @portabletext/markdown is the official Portable Text markdown library from the Sanity ecosystem; appropriate for this package. | ai | |
| dependencies | unvetted-dep:promptfoo | AI (dependencies): promptfoo is a well-known AI evaluation framework; its use is appropriate and expected for this AI Literacy Framework evaluation tool. | ai | |
| dependencies | unvetted-dep:dotenv-cli | AI (dependencies): dotenv-cli is a standard utility for loading .env files in CLI contexts; used in package.json scripts for promptfoo commands. | ai | |
| dependencies | unvetted-dep:@sanity/client | AI (dependencies): @sanity/client is the official Sanity.io client; expected dependency for a Sanity-scoped evaluation tool. | ai | |
| semgrep | semgrep:env-spread | AI (semgrep): env spread is used to pass parent environment to a child subprocess (execFileSync), a standard CLI pattern. No exfiltration; stable for this package. | ai | |
| phantom-deps | phantom-dep:dotenv-cli | AI (phantom-deps): dotenv-cli is used as a CLI wrapper in npm scripts (dotenv -e ... -- promptfoo), not imported directly. Expected usage pattern. | ai | |
| phantom-deps | phantom-dep:promptfoo | AI (phantom-deps): promptfoo is invoked as a CLI command in npm scripts, not imported directly. This is expected usage for a CLI orchestration tool. | ai |
Versions (showing 12 of 118)
| Version | Deps | Published |
|---|---|---|
| 0.1.11 | 10 / 7 | |
| 0.1.10 | 10 / 7 | |
| 0.1.9 | 10 / 7 | |
| 0.1.8 | 10 / 7 | |
| 0.1.7 | 10 / 7 | |
| 0.1.6 | 10 / 6 | |
| 0.1.5 | 10 / 6 | |
| 0.1.4 | 10 / 6 | |
| 0.1.3 | 10 / 6 | |
| 0.1.2 | 10 / 6 | |
| 0.1.1 | 10 / 6 | |
| 0.1.0 | 10 / 6 |
v0.1.11
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.1.10
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.1.9
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.1.8
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.1.7
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.1.6
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.1.5
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.1.4
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.1.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.1.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.