registry / @fusengine/harness / 0.1.49

@fusengine/harness@0.1.49

Harness-agnostic toolkit for AI coding agents: runtime harness detection (Claude Code, Codex, Cursor, Cline, Gemini, Aider...), pure policy core (env config, project/framework detection, SOLID/file-size limits, APEX freshness, guard patterns, portable pro

AI Security Review

scanned 19d ago · by lpm-firewall-ai

No confirmed malicious attack surface is established. The package is an AI-agent harness/guard CLI with explicit hook initialization, local policy checks, logging/state writes, and user-invoked network lookups.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Trigger

user runs exported `harness` CLI commands or configured harness hooks

Impact

local hook configuration and guard decisions; no confirmed exfiltration or unconsented lifecycle mutation

Mechanism

package-aligned AI-agent guard and hook runtime

Rationale

The suspicious primitives are consistent with the package's documented purpose as a harness guard CLI and are activated by explicit CLI/hook use, not install-time or import-time execution. I found no source evidence of credential theft, persistence beyond requested hook wiring, destructive payloads, or unauthorized AI-agent control-surface mutation.

Evidence

package.jsondist/cli/bin.mjsdist/run-Do2JltgU.mjsdist/run-DZvP_9xB.mjsdist/evaluate-CNAzgxnN.mjsdist/handle-D1hHqHvh.mjs.claude/settings.json.codex/hooks.json.cursor/hooks.json.gemini/settings.json.clinerules/hooks/PreToolUse.clinerules/hooks/PostToolUse~/.claude/logs~/.fuse-harness/state

Network endpoints

@fusengine/harness@0.1.49

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code