registry / @axiomantic/braid / 0.1.0

@axiomantic/braid@0.1.0

Sub-Second APFS Copy-on-Write Workspaces & Zero-Mirage Git Weaving Engine

AI Security Review

scanned 11d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. An automatic installation hook modifies configuration for multiple AI coding assistants when their base directories exist. This is an unconsented cross-application control-surface write.

Static reason

One or more suspicious static signals were detected.

Trigger

Installing the npm package runs the post-install lifecycle hook.

Impact

Installed AI coding assistants can load package-supplied instructions without the user's explicit setup action.

Mechanism

The hook creates rule or instruction directories as needed and writes braid.md containing package-supplied agent instructions.

Policy narrative

During npm installation, the package automatically invokes its post-install script. If it detects supported assistant configuration roots, it writes package-controlled instruction files into Claude Code, OpenCode, and Antigravity locations. The behavior crosses into existing AI-agent control surfaces without an explicit user command or consent prompt.

AI rationale

The automatic lifecycle hook writes instructions into several foreign AI-agent configuration trees. This concrete unconsented control-surface mutation meets the blocking policy.

Evidence

package.jsonscripts/postinstall.js.claude/rules/braid.md.config/opencode/instructions/braid.md.gemini/antigravity/rules/braid.md

Decision evidence

public snapshot

@axiomantic/braid@0.1.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code