{"actions":{"bootstrapAndRun":{"effect":"installs rote if missing, inspects, prepares, and asks before running","href":"https://play.modiqo.ai/install?play=lgoyal6/npm-scripts-audit@0.3.0","method":"GET","rel":"https://rote.dev/rels/bootstrap-and-run","requiresConsent":true,"responseMediaType":"text/x-shellscript"},"inspect":{"command":"rote play inspect https://play.modiqo.ai/lgoyal6/npm-scripts-audit@0.3.0","effect":"read-only"},"installCliOnly":{"effect":"installs the rote CLI, nothing else","href":"https://play.modiqo.ai/install","method":"GET","rel":"https://rote.dev/rels/install-cli","requiresConsent":true,"responseMediaType":"text/x-shellscript"},"run":{"command":"rote play run https://play.modiqo.ai/lgoyal6/npm-scripts-audit@0.3.0","effect":"executes the play locally after consent","headless":{"approvalAssertion":"--yes","approvalRequiredBeforeInvocation":true,"commandTemplate":"rote play run https://play.modiqo.ai/lgoyal6/npm-scripts-audit@0.3.0 <name=value...> --yes","stdinPolicy":"never pipe input to automate the interactive Ready selector"},"requiresConsent":true}},"description":"Audits the npm code that runs without anyone reading it. Two halves, both fully offline: your own package.json scripts (a remote URL piped into a shell, a recursive delete whose target expands at run time or resolves outside the project, a write outside the project directory, a binary no declared dependency provides, npm publish with no prepublishOnly guard) and, the expensive half, every INSTALLED dependency that carries a preinstall, install or postinstall hook. Those hooks execute arbitrary code with your privileges on every npm install, so the play follows each hook command into the package files it actually runs and reports whether the code reaches the network, compiles locally, or does nothing, with the file and line as evidence. No registry call, no API key, no credentials.","distribution":{"digest":"sha256:a3b1b4926ad60685f99ca986d6e95586c4174034c537c455c02b0f55c35bb130","mediaType":"application/vnd.modiqo.rote-flow","size":21272,"verifiedBy":"rote verifies the downloaded archive against this digest before it runs"},"effects":{"credentialsProvidedBy":"runner","credentialsRemainLocal":true,"declaredWrites":[],"publisherReceivesCredentials":false},"id":"https://play.modiqo.ai/lgoyal6/npm-scripts-audit@0.3.0","inputPolicy":{"optionalWithDefault":"show_default_and_accept_override","optionalWithoutDefault":"omit_unless_supplied","required":"ask","secrets":"collect_locally_outside_conversation"},"links":{"docs":"https://rote.dev","page":"https://play.modiqo.ai/lgoyal6/npm-scripts-audit@0.3.0","protocol":"https://play.modiqo.ai/.well-known/rote","self":"https://play.modiqo.ai/lgoyal6/npm-scripts-audit@0.3.0.json"},"name":"npm-scripts-audit","owner":{"kind":"user","slug":"lgoyal6"},"parameters":[{"description":"Project directory to audit; its package.json and every node_modules tree beneath it","example":".","input":{"allowCustom":true,"choices":[],"label":"Root"},"name":"root","required":true,"type":"string"},{"default":"4","description":"How many directory levels below root to search for project package.json files","example":"3","input":{"allowCustom":true,"choices":[],"label":"Depth"},"name":"depth","required":false,"type":"string"}],"preparation":[{"action":{"command":"rote play inspect https://play.modiqo.ai/lgoyal6/npm-scripts-audit@0.3.0 --json","effect":"read-only"},"step":1,"type":"inspect_local_readiness"},{"references":["/parameters"],"step":2,"type":"collect_parameters"},{"references":["/parameters","/requirements","/effects"],"step":3,"type":"review"},{"consentBoundary":"the user approves the exact play and parameter values","references":["/parameters","/requirements","/effects"],"step":4,"type":"obtain_run_consent"},{"action":{"command":"rote play run https://play.modiqo.ai/lgoyal6/npm-scripts-audit@0.3.0","headlessCommandTemplate":"rote play run https://play.modiqo.ai/lgoyal6/npm-scripts-audit@0.3.0 <name=value...> --yes"},"preservesAcquisitionBoundaries":["adapter_selection","oauth_dcr","google_discovery","static_token_setup","runtime_security_checks"],"requiresConsent":true,"step":5,"type":"run"}],"producedBy":{"roteVersion":"0.78.0"},"publishedAt":"2026-09-02T19:46:59.730921+00:00","reference":"lgoyal6/npm-scripts-audit@0.3.0","requirements":{"adapters":[],"browser":{"dependencies":[],"runtime":false,"signIn":false},"localTools":["bash","python3","find","grep","sort","head","mktemp","rm"],"roteCli":{"minimumVersion":"0.62.0"},"sessions":false},"resolution":"pinned","schema":"rote.play.v1","stats":{"downloads":1,"installs":0},"steps":{"count":2,"names":["analyze","discover"]},"title":"npm-scripts-audit","type":"play","version":"0.3.0","visibility":"public"}