registry / @in-the-loop-labs/pair-review / 4.0.0

@in-the-loop-labs/pair-review@4.0.0

Your AI-powered code review partner - Close the feedback loop with AI coding agents

AI Security Review

scanned 4h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User starts a review using the Antigravity provider or enables configured provider/hooks.

Impact

A compromised or prompt-injected external AI CLI could modify the review worktree or run commands within its granted environment.

Mechanism

User-configured shell and AI-agent execution for code review

Rationale

The package has no install-time behavior or confirmed exfiltration/persistence chain, but it exposes a user-invoked, permission-bypassing agent execution path. This warrants a warning for dangerous capability, not a publication block.

Evidence

package.jsonbin/pair-review.jssrc/ai/antigravity-provider.jssrc/ai/codex-provider.jssrc/ai/analyzer.jssrc/config.jssrc/hooks/hook-runner.js~/.pair-review/config.json~/.pair-review/worktrees/

Decision evidence

public snapshot

AI called this at 90.0% confidence with false-positive risk.

@in-the-loop-labs/pair-review@4.0.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code