registry / @getcoherent/cli / 0.22.8

@getcoherent/cli@0.22.8

CLI interface for Coherent Design Method

AI Security Review

scanned 2h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. No install-time attack behavior is present. Explicit Coherent CLI commands can create or replace first-party project AI-agent context files and, during component generation, install validated frontend dependencies.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User runs `coherent init`, `coherent rules`, `coherent sync`, `coherent update`, or generation commands.

Impact

Project-local AI configuration and generated-project dependencies can change; no foreign or broad agent-control mutation was confirmed.

Mechanism

Explicit project scaffolding, AI-context regeneration, and generation-time dependency installation.

Rationale

The static malicious label is not supported by source inspection. The package presents an explicit, first-party project agent-extension lifecycle risk, which warrants warning rather than blocking under the stated policy.

Evidence

package.jsonbin/coherent.jsdist/index.jsdist/chunk-75FWKKIT.jsdist/claude-KGAIPICW.js.cursorrulesCLAUDE.mdAGENTS.md.claude/commands.claude/skills.claude/settings.json~/.coherent/update-check.json

Network endpoints2

/@getcoherent/cli/latest

@getcoherent/cli@0.22.8

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code