registry / @dot-agent/cli / 0.11.1

@dot-agent/cli@0.11.1

CLI toolkit for building, packaging, and executing deterministic FSM-based agents

AI Security Review

scanned 8h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

No blocking static signals were detected.

Trigger

User runs `dot-agent configure` or a prepare lifecycle runs in a Git checkout.

Impact

An AI client can invoke local `dot-agent` MCP servers after user-directed configuration.

Mechanism

Registers local dot-agent MCP commands and writes first-party skill/config files.

Rationale

Source inspection found a real, user-invoked AI-agent control-surface mutation and a prepare-only Git hook-path change, so policy requires a warning. The behavior is package-aligned and local, with no concrete malicious chain.

Evidence

package.jsondist/src-I0e2KQ_c.mjsassets/helper.agenthelper-src/helper.behaviorscripts/ensure-license-headers.shskills/dot-agent/SKILL.md~/.claude.json~/.claude/skills/dot-agent/SKILL.md~/.gemini/config/mcp_config.json~/.gemini/config/skills/dot-agent/SKILL.md~/.config/murici/mcp.json

@dot-agent/cli@0.11.1

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code