registry / @expertintegrado/create-expert-brain / 1.4.0

@expertintegrado/create-expert-brain@1.4.0

Scaffolder do Expert Brain — um grafo de conhecimento pessoal pro Claude rodando 100% no free tier da Cloudflare.

AI Security Review

scanned 3h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. An explicitly invoked setup provisions a user Cloudflare Worker and installs Expert Brain hooks into Claude Code's user configuration. The hooks influence agent behavior to recall/save notes and tasks; no unconsented install-time Claude configuration mutation was found.

Static reason

One or more suspicious static signals were detected.

Trigger

User runs `npm run setup` after invoking the scaffolder.

Impact

Persistent agent behavior prompts plus storage of user-approved knowledge in the deployed Expert Brain service.

Mechanism

Explicit Claude Code hook installation and Cloudflare deployment.

Rationale

The package is not concretely malicious, but its explicit setup persistently modifies Claude Code behavior and configuration. This fits a warn-level first-party agent extension lifecycle risk.

Evidence

bin.mjstemplate/package.jsontemplate/scripts/setup.mjstemplate/scripts/install-claude-hooks.mjstemplate/scripts/claude-hooks/expert-brain-session-start.cjstemplate/src/notify.ts~/.claude/settings.json~/.claude/hooks/expert-brain-*.cjs~/.claude/logs/*.jsonlwrangler.toml.git/hooks/pre-commit

Network endpoints1

@expertintegrado/create-expert-brain@1.4.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code