registry / @lousy-agents/lint / 5.17.5

@lousy-agents/lint@5.17.5

Programmatic lint API for validating AI coding assistant configurations — skills, agents, hooks, and instructions

AI Security Review

scanned 2h ago · by lpm-firewall-ai

Calling `runLint` on a directory can load and execute that directory's JavaScript/TypeScript lint configuration. A config-controlled remote `extends` source can also download content through the bundled c12/giget resolver.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Consumer calls `runLint({ directory })` on a project containing a loadable lousy-agents configuration or remote extend.

Impact

Untrusted project configuration can achieve code execution in the lint caller's process; remote extends can cause network access and cache writes.

Mechanism

configuration import and conditional remote-template download

Rationale

Source inspection finds a real configuration-driven RCE/network surface in a package presented as a lint API, but no covert install hook, exfiltration, or destructive chain. Warn rather than block.

Evidence

package.jsondist/index.jsdist/653.jsdist/913.jsdist/index.d.ts

Decision evidence

public snapshot

AI called this Suspicious at 87.0% confidence as Critical Vulnerability with low false-positive risk.

Evidence for warning

`dist/index.js` calls `loadConfig` on the caller-supplied directory.

@lousy-agents/lint@5.17.5

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code