registry / @keemgunn/lanesmith / 1.3.0

@keemgunn/lanesmith@1.3.0

A personal Git workflow CLI for repo onboarding, branching, Release Lane Models, and release workflows.

AI Security Review

scanned 21d ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. npm postinstall runs local bootstrap code that refreshes Lanesmith settings and previously installed Lanesmith agent-harness assets. The refresh is scoped to detected package-owned assets, but modifies global agent command locations without an explicit command.

Static reason

One or more suspicious static signals were detected.

Trigger

npm installation

Impact

Previously installed Lanesmith prompts, commands, skills, and default settings may be overwritten or seeded.

Mechanism

guarded refresh of package-owned global settings and agent-harness files

Rationale

The postinstall mutation merits a warning under the agent-extension lifecycle policy, but its discovery gate and package-owned destinations prevent a malicious/block verdict. No concrete exfiltration, remote execution, or destructive chain was found.

Evidence

scripts/postinstall.mjsdist/cli/bootstrap-harness.jsdist/infra/agent-harness/detect.jsdist/infra/agent-harness/install.jsdist/domain/agent-harness-locations.jsdist/infra/settings/bootstrap.jsdist/cli/bootstrap-settings.js~/.lanesmith/settings.toml~/.lanesmith/.default-settings/~/.codex/prompts~/.claude/commands/lanesmith~/.cursor/commands/lanesmith~/.agents/skills/lanesmith

@keemgunn/lanesmith@1.3.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code