registry / @fugood/bricks-ctor / 2.24.12

@fugood/bricks-ctor@2.24.12

AI Security Review

scanned 21h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. No install-time execution is declared. An explicitly run setup script can modify project-local AI-agent configuration and register a local MCP server with pre-approved tools.

Static reason

No blocking static signals were detected.

Trigger

Explicit execution of tools/postinstall.ts in a project containing AGENTS.md or CLAUDE.md.

Impact

Can expand an agent's available local command and file-upload capabilities in that project.

Mechanism

Project-local MCP and agent-skill configuration mutation.

Rationale

No concrete malicious install-time or covert exfiltration chain was found. The project-local agent configuration and broad MCP approval capability warrant a warning rather than a block.

Evidence

package.jsonindex.tstools/postinstall.tstools/_mcp-config.tstools/mcp-server.tstools/mcp-tools/media.tstools/mcp-tools/huggingface.tstools/mcp-tools/lottie.ts.codex/config.toml.mcp.json.bricks/skills.claude/skills.codex/skills.claude/settings.local.json.gitignore

Network endpoints2

huggingface.co/api

@fugood/bricks-ctor@2.24.12

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code