registry / @lovrabet/lovrabet-cli / 2.2.2

@lovrabet/lovrabet-cli@2.2.2

Runtime CLI for Lovrabet apps, datasets, SQL, BFF, skills, and AI agent workflows.

AI Security Review

scanned 19d ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. On npm installation, the package loads its postinstall module and globally installs a Lovrabet built-in agent skill through npx. This mutates an agent-extension surface without an explicit user command, but the source identifies it as first-party skill setup and validates the packaged skill manifest.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm postinstall

Impact

Installs a Lovrabet agent skill into global skill locations; no exfiltration or destructive behavior was confirmed.

Mechanism

automatic global built-in agent-skill installation via npx

Rationale

The automatic global skill installation merits a warning under the extension lifecycle policy. It does not meet the blocking threshold for concrete malicious behavior or foreign/broad agent-control hijacking.

Evidence

package.jsonscripts/postinstall.mjslib/postinstall.jslib/skills/builtin-skill.jslib/skills/npx-skills-add.jsskills/lovrabet.manifest.jsonlib/commands/update.js

Decision evidence

public snapshot

AI called this Suspicious at 89.0% confidence as Dangerous Capability with low false-positive risk.

@lovrabet/lovrabet-cli@2.2.2

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code