registry / @fingerskier/augment / 0.1.10

@fingerskier/augment@0.1.10

Local RAG memory system for coding agents

AI Security Review

scanned 11h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

No blocking static signals were detected.

Trigger

User runs `augment install codex|claude|all`.

Impact

Can persist an Augment MCP server and inject package-defined memory guidance into configured Codex/Claude sessions.

Mechanism

Writes agent configuration and installs local memory-recall hooks.

Rationale

Source inspection confirms explicit user-command agent configuration mutation and hook registration, not autonomous malicious behavior. Downgrade to warn under the agent-extension policy.

Evidence

package.jsondist/install.jsdist/hooks.jsdist/daemon/http.jsdist/daemon/client.js~/.claude.json~/.claude/CLAUDE.md~/.agents/plugins/marketplace.jsonplugins/augment/.codex-plugin/plugin.jsonplugins/augment/.mcp.jsonplugins/augment/hooks/hooks.json

Network endpoints1

127.0.0.1

@fingerskier/augment@0.1.10

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code