registry / @jcr-adk/cli / 2.1.0

@jcr-adk/cli@2.1.0

JCR ADK (Jason Cursor ADK) — cli

AI Security Review

scanned 4h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

No blocking static signals were detected.

Trigger

User runs jcr-adk project --with-cursor-assets/--only cursor or --install-deps

Impact

Changes the selected workspace's AI-agent guidance files; dependency install may execute that workspace's lifecycle scripts.

Mechanism

Opt-in project scaffolding and agent-configuration writes

Rationale

The package exposes an explicit AI-agent configuration mutation capability, warranting a warning under policy. Source inspection found no lifecycle execution, credential theft, remote payload loading, or covert network exfiltration.

Evidence

package.jsonbin/jcr-adk.mjsdist/cursor-assets.jsdist/commands/project.jsdist/install-deps.jsdist/commands/run.js.cursor/rules/jcr-adk-core.mdc.cursor/rules/jcr-adk-plan.mdcAGENTS.md

Network endpoints1

127.0.0.1

@jcr-adk/cli@2.1.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code