@lightupai/polaris@0.0.98
⚠ Under reviewRecord and stream Claude Code sessions to Slack. Like Gong for AI coding — capture every prompt, response, and tool call. Multiplayer collaboration across AI coding agents.
AI Security Review
scanned 16d ago · by lpm-firewall-aiThe manifest has no npm install lifecycle hook, and inspected Slack and session behavior is consistent with the package's collaboration features. The CLI is a primary entry point for agent integration, but its unsupported NUL-containing artifact leaves material behavior unresolved, so manual review is warranted.
Decision evidence
public snapshot- The manifest declares CLI entry points and a test script, with no npm install lifecycle hook.
- The CLI wrapper launches src/cli/cli.ts, whose complete behavior remains unresolved because the inspected artifact is unsupported and contains NUL bytes.
- Readable CLI excerpts show user-level Claude Code hook and MCP setup that merges with existing settings, but do not resolve the entire CLI implementation.
Source & flagged code
6 flaggedPackage source references child process execution.
scripts/perf-audit.tsView on unpkg · L14A single source file combines environment access, network access, and code or shell execution; review context before blocking.
scripts/perf-audit.tsView on unpkg · L33Findings
Affected versions and remediation
This report applies to @lightupai/polaris@0.0.98.
See all versions of @lightupai/polaris for other recorded verdicts.
- Review the evidence and your use of @lightupai/polaris@0.0.98 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.