registry / @askrjs/cli / 0.0.4

@askrjs/cli@0.0.4

Unified CLI for the Askr platform

AI Security Review

scanned 9h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User runs `askr skills install`, `askr skills sync`, `askr create`, or `askr ssg --config <path>`.

Impact

Modifies the selected project and may add first-party agent skill definitions; no unconsented install-time or foreign control-surface mutation is established.

Mechanism

Explicit project scaffolding, skill copying, and user-config import.

Rationale

Source inspection confirms a user-invoked agent-skill installation capability, so it warrants a warning under the firewall policy. No concrete malicious chain, install lifecycle execution, credential theft, exfiltration, or stealth persistence was found.

Evidence

package.jsondist/cli.jsdist/skills-B7CbWur9.jsdist/create.jsdist/ssg.jsdist/generate.jsdist/registry-CyrRHRG5.js<cwd>/skills/askr-*<created-project>/.askr/builder-brief.md<created-project>/package.json<user-supplied-ssg-config>

@askrjs/cli@0.0.4

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code