registry / @godxjp/ui / 18.0.0

@godxjp/ui@18.0.0

@godxjp/ui — shared React UI framework (shadcn + Radix + Tailwind v4).

AI Security Review

scanned 16d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package automatically changes a consumer project's AI-agent MCP configuration. It registers a command-backed MCP server that can be invoked by an agent later.

Static reason

One or more suspicious static signals were detected.

Trigger

npm install lifecycle (postinstall) in a consumer project

Impact

Changes a foreign AI-agent control surface and authorizes later execution of an additional package command.

Mechanism

unconsented .mcp.json mutation registering npx @godxjp/ui-mcp

Policy narrative

On install, postinstall selects the consumer working directory and writes or augments its .mcp.json. It adds a godx-ui MCP entry whose command is npx @godxjp/ui-mcp. This alters a consumer-owned AI-agent configuration without an explicit setup command, allowing a later agent session to execute the registered MCP package.

Rationale

The package performs an unconsented postinstall mutation of a foreign AI-agent control surface. This meets the firewall block boundary even though the separately provided hook workflow is explicit-user-command only.

Evidence

package.jsonscripts/postinstall.mjsscripts/_agent-setup.mjsscripts/init-agent-kit.mjsscripts/cli.mjs.mcp.json

Decision evidence

public snapshot

@godxjp/ui@18.0.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code