registry / @askrjs/cli / 0.0.3

@askrjs/cli@0.0.3

Unified CLI for the Askr platform

AI Security Review

scanned 1d ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. No install-time malicious behavior is established. Explicit CLI commands can copy package-bundled agent skill files into a selected project and remove prior managed `askr-*` skill folders during sync.

Static reason

No blocking static signals were detected.

Trigger

User runs `askr skills install`, `askr skills sync`, or `askr create`.

Impact

Modifies selected project's `skills/askr-*` agent-extension content; sync can remove obsolete managed folders.

Mechanism

Explicit first-party agent-skill deployment and managed-directory synchronization.

Rationale

Source inspection finds no malicious install-time or covert behavior, but the package intentionally mutates agent-facing skill content through explicit commands. Per policy, classify this first-party agent-extension setup as warn rather than block.

Evidence

package.jsondist/cli.jsdist/skills-Bh0mEhIx.jsdist/create.jsskills/askr-agent-execution/agents/openai.yamlskills/askr-*dist/skills/askr-*<selected-project>/skills/askr-*

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Dangerous Capability with false-positive risk.

@askrjs/cli@0.0.3

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code