[brycebaril]

The N|Solid MCP server's list_behaviors now marks a behavior notInScan: the package's published code imports none of the Node.js modules it was seen calling to run programs or compile code. Such a behavior weighs a step more, and the package version fails observed-not-in-scan in app_packages.

ns-analyze-behaviors now says what the mark means. It also says how app_packages' failing checks can explain it: risk/uses-dynamic-require (a module imported by a computed name) and risk/uses-eval (code compiled from a string). With neither, an unusual loader or code fetched at run time is the likely route, and either is a strong sign.

No tool or argument changes.

🤖 Generated with Claude Code

[ns-control-tower]

Walkthrough

Docs-only change to skills/ns-analyze-behaviors/SKILL.md (+2 lines, 1 file, no code, no tool or argument changes). It documents the new notInScan mark that list_behaviors can put on a behavior:

• Line 15 defines notInScan next to versionChange: the package's published code imports none of the modules it was seen calling, so the module was reached another way; it weighs a step more, and the package version fails observed-not-in-scan in app_packages.
• Line 23 adds a notInScan sub-bullet under New capability, pointing at app_packages (with the app) for the version's failing checks, naming risk/uses-dynamic-require and risk/uses-eval, and — when neither fails — an unusual loader (module.constructor._load) or code fetched at run time as the remaining routes.

Assessment

• No correctness, security, performance, or compatibility findings.
• Prose only: no script, manifest, bundle.json, or generated artifact needs a matching update. The skill keeps a single canonical copy under skills/ (verified in the review clone: exactly one ns-analyze-behaviors/SKILL.md in the tree, and the Pi/native-plugin copies are materialized at pack time only), so there is nothing else to regenerate.
• Placement matches the stated scope: notInScan is defined for the "running programs or compiling code" case (line 15), so documenting its follow-up under the New capability (process / code) bullet at line 23 is consistent, and the wording and one-bullet-per-line style follow the surrounding file (versionChange, line 14).
• The identifiers used (app_packages, observed-not-in-scan, risk/uses-dynamic-require, risk/uses-eval) match the PR description and the commit message.
• Assumption stated for the record: those identifiers belong to the external nsolid MCP server and appear nowhere else in this repository, so they could not be checked against repo-local source; they are taken as given from the server-side change the same author describes.
• CI: test run 39909332517 (.github/workflows/test.yml) was still in progress at review time. It lints, builds and tests code and only asserts that skill files exist, so a prose-only edit is not exercised by it — no CI signal was relied on for this verdict.
• No PR Lens diagram: the diff is pure prose with no component interaction to draw.

Verdict: APPROVE — docs-only clarification, no blocking findings.