registry / @fusengine/harness / 0.1.44

@fusengine/harness@0.1.44

Harness-agnostic toolkit for AI coding agents: runtime harness detection (Claude Code, Codex, Cursor, Cline, Gemini, Aider...), pure policy core (env config, project/framework detection, SOLID/file-size limits, APEX freshness, guard patterns, portable pro

AI Security Review

scanned 19d ago · by lpm-firewall-ai

No confirmed malicious attack surface. Sensitive primitives are tied to explicit CLI commands or documented hook runtime behavior for an AI-agent policy harness.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Trigger

Explicit user commands such as `harness init`, `harness hook`, `harness doctor`, `harness changelog`, or `harness check`.

Impact

Can write harness config/state files and perform documented local/network checks when invoked; no unconsented install/import behavior found.

Mechanism

Documented policy/hook wiring and local guard enforcement

Rationale

Static inspection found a documented AI-agent harness with potentially sensitive but user-invoked hook/state/network behavior, not install-time or import-time malware. Scanner hits are explained by policy scanning patterns, hook initialization, local state, and optional diagnostics.

Evidence

package.jsonREADME.mddist/cli/bin.mjsdist/run-Do2JltgU.mjsdist/run-DLXtA5DH.mjsdist/handle-CtMMVoxT.mjsdist/index.mjsdist/cli/index.mjsdist/dotenv-B9nM4cuQ.mjsdist/claude-DLh0fHWM.mjs.claude/settings.json.codex/hooks.json.cursor/hooks.json.gemini/settings.json.clinerules/hooks/PreToolUse.clinerules/hooks/PostToolUse

@fusengine/harness@0.1.44

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code