registry / @alfalab/core-components-mcp / 0.2.1

@alfalab/core-components-mcp@0.2.1

MCP server providing component information for core UI components.

AI Security Review

scanned 3h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

No blocking static signals were detected.

Trigger

User runs the package binary with `add-skill`.

Impact

Can replace the package-owned core-components agent guidance files.

Mechanism

Copies bundled Markdown skill files into a project-local agent configuration path.

Rationale

This is a disclosed but overwriting AI-agent configuration mutation on an explicit user command. Per policy, it warrants a warning rather than a block.

Evidence

package.jsondist/index.mjsdist/add-skill.mjsREADME.mddist/skills/SKILL.mddist/skills/MCP.md.agents/skills/core-components/SKILL.md.agents/skills/core-components/MCP.md

Decision evidence

public snapshot

AI called this Suspicious at 95.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

@alfalab/core-components-mcp@0.2.1

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code