registry / @kontourai/datum / 0.5.0

@kontourai/datum@0.5.0

Portfolio AI provider/model registry: define providers, models, roles once; resolve which backend, which model, whose key, what base URL. Never makes model calls.

AI Security Review

scanned 4h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

No blocking static signals were detected.

Trigger

User runs `datum sync opencode` or `datum sync claude-code --role <name>`; network requires explicit doctor --probe, discover, or test-connection.

Impact

Can change selected model and endpoint for later AI-agent sessions; does not write secrets or run during installation.

Mechanism

Explicit agent-config generation/merge and opt-in provider probes

Rationale

No concrete malicious or unconsented install-time behavior was found. The explicit AI-agent configuration mutation warrants a warning under the stated policy.

Evidence

package.jsonbin/datum.mjsdist/src/claudecode.jsdist/src/opencode.jsdist/src/doctor.jsdist/src/discover.js~/.config/opencode/opencode.json~/.claude/settings.json~/.config/kontour/datum.json.datum/config.json

Network endpoints3

api.anthropic.com/v1/messagesapi.openai.com/v1/chat/completions/v1/models

@kontourai/datum@0.5.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code