registry / @fusengine/harness / 0.1.42

@fusengine/harness@0.1.42

Harness-agnostic toolkit for AI coding agents: runtime harness detection (Claude Code, Codex, Cursor, Cline, Gemini, Aider...), pure policy core (env config, project/framework detection, SOLID/file-size limits, APEX freshness, guard patterns, portable pro

AI Security Review

scanned 20d ago · by lpm-firewall-ai

No confirmed malicious attack surface is established. The package is an AI coding-agent harness with explicit CLI commands that install local hook wiring and enforce policy checks; one git-show shell interpolation is a security bug but not evidence of malicious intent.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User invokes the harness CLI, especially harness init, harness check, doctor, changelog, or configured hook execution.

Impact

Can write local harness config/state files and make diagnostic network requests; no credential harvesting or exfiltration was found.

Mechanism

User-invoked local hook wiring and policy/runtime state management

Rationale

Static inspection shows package-aligned AI harness behavior activated by explicit CLI/hook use, not install-time compromise or covert exfiltration. The unsanitized git show command in check mode is a real vulnerability risk, but it does not support a malicious package verdict by itself.

Evidence

package.jsondist/cli/bin.mjsdist/run-Do2JltgU.mjsdist/run-jgivVDv6.mjsdist/evaluate-CeivW6G0.mjsdist/handle-BTHcKWQ5.mjs.claude/settings.json.codex/hooks.json.cursor/hooks.json.gemini/settings.json.clinerules/hooks/PreToolUse.clinerules/hooks/PostToolUse.harness/.gitignore~/.claude/logs/00-changelog/<date>-state.json

@fusengine/harness@0.1.42

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code