registry / @lovrabet/lovrabet-cli / 2.1.22

@lovrabet/lovrabet-cli@2.1.22

Runtime CLI for Lovrabet apps, datasets, SQL, BFF, skills, and AI agent workflows.

AI Security Review

scanned 24d ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

One or more suspicious static signals were detected.

Trigger

User runs `lovrabet skill install`, `lovrabet cli-skill install`, or `lovrabet update`.

Impact

Remote vendor-controlled instructions can become available to local AI-agent runtimes.

Mechanism

Remote Skill download and global agent-Skill directory linking.

Rationale

No concrete malware, stealth persistence, credential harvesting, or unconsented install-time mutation was found. The package nevertheless provides explicit remote AI-agent Skill installation, which warrants a warning under the stated policy.

Evidence

package.jsonlib/commands/skill/commands/install.jslib/skills/runtime-skill-sync/paths.jslib/skills/runtime-skill-sync/links.jslib/commands/cli-skill/index.jslib/commands/update.js~/.lovrabet/cache~/.agents/skills~/.claude/skills~/.workbuddy/skills

Network endpoints2

skills.lovrabet.comregistry.npmjs.org

@lovrabet/lovrabet-cli@2.1.22

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code