
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
Command-line tool for Intent Spec: extract agent-readable metadata from Solidity contracts using custom NatSpec tags and emit schema-compliant JSON.
@custom:agent-* NatSpec tags (see NatSpec tags)From any directory:
npx intentspec compile
npx intentspec extract-natspec --file path/to/Contract.sol
npm install -g intentspec
Then run from anywhere:
intentspec compile
intentspec extract-natspec -f contracts/MyContract.sol
npm install --save-dev intentspec
Use via npx in scripts or locally:
npx intentspec compile
git clone <repo-url>
cd intent-spec/cli
npm install
npm run build
Run the built CLI:
node dist/index.js compile
# or link globally: npm link && intentspec compile
compileScans a directory for all .sol files (recursively, excluding node_modules and .git), extracts Intent Spec metadata from each file that contains a contract with valid NatSpec, and writes one JSON file per contract into an intentspec/ folder.
Usage:
intentspec compile
intentspec compile --dir /path/to/contracts
intentspec compile -d ./src
| Option | Description | Default |
|---|---|---|
-d, --dir <path> | Root directory to search for .sol files | Current directory (.) |
Behavior:
intentspec/ in the root directory you specify..sol file that has a contract and at least one function with @custom:agent-intent, writes intentspec/<ContractName>.json.Example:
cd my-project
intentspec compile
# → Creates intentspec/Token.json, etc.
extract-natspecReads a single Solidity file, extracts Intent Spec from it, and prints the JSON to stdout (no file written).
Usage:
intentspec extract-natspec
intentspec extract-natspec --file contracts/MyContract.sol
intentspec extract-natspec -f ./src/Proxy.sol
| Option | Description | Default |
|---|---|---|
-f, --file <path> | Path to the Solidity file | Built-in default path (for development) |
Paths are resolved relative to the current working directory. Use this for quick inspection or piping into other tools.
Example:
intentspec extract-natspec -f contracts/UserProxy.sol | jq .
The CLI only includes in the spec what you declare with these tags. Put them in block comments (/** ... */) directly above the contract or function.
contract Name {)| Tag | Purpose | Example |
|---|---|---|
@custom:agent-version | Contract version | @custom:agent-version 1.0 |
@custom:agent-description | Short description | @custom:agent-description Proxy for user ops. |
@custom:agent-invariant | Invariant (can repeat) | @custom:agent-invariant owner is immutable. |
@custom:agent-event | Event name + description | @custom:agent-event Transfer Token balance change. |
function)| Tag | Purpose | Example |
|---|---|---|
@custom:agent-intent | Required. One-line intent | @custom:agent-intent Withdraws ERC20 to an address. |
@custom:agent-precondition | Precondition (can repeat) | @custom:agent-precondition Caller is owner or user. |
@custom:agent-effect | Effect (can repeat) | @custom:agent-effect Balance decreases; emits Transfer. |
@custom:agent-risk | Risk (can repeat) | @custom:agent-risk Irreversible transfer. |
@custom:agent-guidance | Guidance for agents | @custom:agent-guidance Check balance before calling. |
Only functions that have @custom:agent-intent are included in the generated spec. Preconditions, effects, risks, and guidance are optional and can appear multiple times (they become arrays in JSON).
Generated JSON follows the Intent Spec schema. Each file under intentspec/ looks like:
{
"contract": {
"name": "UserProxy",
"version": "1.0",
"description": "Proxy for user operations."
},
"functions": [
{
"name": "withdrawERC20",
"signature": "0x44004cc1",
"intent": "Withdraw a specific amount of ERC20 tokens to an address.",
"preconditions": ["Caller is owner or user.", "token and to are non-zero."],
"effects": ["Balance decreases; to receives tokens. Emits TokensWithdrawn."],
"risks": ["Irreversible transfer."],
"agentGuidance": "Check balance first."
}
],
"events": [
{ "name": "TokensWithdrawn", "description": "Emitted when tokens are withdrawn." }
],
"invariants": ["owner and user are set at construction and immutable."]
}
signature is the EVM function selector in hex (first 4 bytes of keccak256(functionSignature)).contract and functions are required; events and invariants are optional.@custom:agent-* tags (see NatSpec tags).npx intentspec compile
intentspec/<ContractName>.json and use it for agents, docs, or publishing (e.g. IPFS + onchain pointer).Re-run intentspec compile after changing NatSpec to refresh the JSON.
| Script | Description |
|---|---|
npm run build | Compile TypeScript and emit to dist/ |
npm run dev | Watch and recompile on change |
npm run start | Run node dist/index.js |
npm run clean | Remove dist/ |
MIT. See LICENSE in this folder.
FAQs
CLI for IntentSpec
We found that intentspec demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.