by arthurpanhku
Approvable, local-first AI coding agent for regulated teams: policy controls, governed MCP, evidence packs, audit trails, secure remediation, and any OpenAI-compatible model.
# Add to your Claude Code skills
git clone https://github.com/arthurpanhku/dvalincodeLast scanned: 8/1/2026
{
"issues": [
{
"type": "npm-audit",
"message": "esbuild: esbuild enables any website to send any requests to the development server and read the response",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "postcss: PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure",
"severity": "high"
},
{
"type": "npm-audit",
"message": "vite: Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling",
"severity": "high"
},
{
"type": "npm-audit",
"message": "vitepress: Vulnerability found",
"severity": "medium"
},
{
"file": "README.md",
"line": 44,
"type": "remote-install",
"message": "Install command (remote install script piped to a shell — review the source before running): \"curl -fsSL https://raw.githubusercontent.com/arthurpanhku/dvalincode/main/script\"",
"severity": "low"
}
],
"status": "WARNING",
"scannedAt": "2026-08-01T06:28:56.340Z",
"npmAuditRan": true,
"pipAuditRan": true,
"promptInjectionRan": true
}dvalincode is an open-source ai agents skill for AI coding assistants such as Claude Code, Codex CLI, and ChatGPT, built by arthurpanhku. Approvable, local-first AI coding agent for regulated teams: policy controls, governed MCP, evidence packs, audit trails, secure remediation, and any OpenAI-compatible model. It has 101 GitHub stars.
dvalincode returned warnings in SkillsLLM's automated security scan. It has no critical vulnerabilities, but review the flagged issues in the Security Report section before adding it to your workflow.
Clone the repository with "git clone https://github.com/arthurpanhku/dvalincode" and add it to your Claude Code skills directory (see the Installation section above).
dvalincode is primarily written in TypeScript. It is open-source under arthurpanhku on GitHub, so you can review or fork the full source.
Yes. SkillsLLM lists many other AI Agents skills you can browse and compare side by side. Open the AI Agents category from the badge at the top of this page, or use the Related Skills and comparison links further down to weigh dvalincode against similar tools.
No comments yet. Be the first to share your thoughts!
Requires a passing catalog security scan. Resolve the flagged issues and resubmit to enable featuring.
Install DvalinCode, then scan the current repository with the built-in rules and
any supported open-source engines available on PATH:
curl -fsSL https://raw.githubusercontent.com/arthurpanhku/dvalincode/main/scripts/install.sh | bash
dvalincode trust
dvalincode dvalin . --scanners builtin,semgrep,trivy,osv-scanner
Use --fix --verify --in-place to let the configured model prepare focused
repairs, run tests, and require a clean re-scan before the result can proceed to
a draft PR. Dvalin never treats its health score as certification; source review
and verification remain mandatory.
This animation is made from the real v0.14.0 application, not a mock. The input is an Apache-2.0-licensed example adapted from OWASP NodeGoat, whose contribution route evaluated user-controlled text.
Code builds software. Dvalin is the second major product surface: it turns open-source scanner evidence into a controlled scan → fix → test → re-scan → draft-PR workflow.
| Real v0.14.0 NodeGoat-derived run | Before | After Dvalin remediation |
|---|---|---|
| Security health (triage heuristic) | 49 / 100 · F | 100 / 100 · A |
| Findings | 6 (eval across 2 rules) |
0 |
| Tests | 2 passing | 3 passing, including an injection regression test |
| Scanner fleet | 4 / 4 completed | 4 / 4 completed |
The scanning and hardening control plane uses open-source components:
The scanners find and rank evidence. The configured model proposes source changes; DvalinCode constrains that work, records the diff, runs project tests, re-scans the changed tree, and keeps PR publication explicit. It does not auto-merge and it does not claim that a clean scan proves the absence of bugs. Choose an open-weight model through Ollama if the repair-proposal step must also stay fully local and open; hosted model licensing depends on the provider.
You can still prove what the agent did after the fact:
dvalincode report verify # re-derive the hash chain of the last run's audit log