registry / @lovrabet/rabetbase-cli / 2.3.13

@lovrabet/rabetbase-cli@2.3.13

Developer CLI for Lovrabet apps, datasets, pages, SQL, BFF, database connections, skills, and AI agent workflows.

AI Security Review

scanned 27d ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

One or more suspicious static signals were detected.

Trigger

User runs `rabetbase cli-skill install`.

Impact

Can alter AI-agent guidance/capabilities after explicit user invocation.

Mechanism

Spawns global npx AI-skill installation.

Rationale

Warn due to the explicit global AI-skill installation capability and opaque shipped code. No lifecycle hook or concrete stealth/exfiltration chain supports a block.

Evidence

package.jsonlib/commands/cli-skill/index.jslib/skills/npx-skills-add.jstemplates/skill/SKILL.md.tpl

Network endpoints2

api.lovrabet.comuser.lovrabet.com

Decision evidence

public snapshot

AI called this Suspicious at 89.0% confidence as Dangerous Capability with low false-positive risk.

@lovrabet/rabetbase-cli@2.3.13

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code