registry / @lovrabet/rabetbase-cli / 2.3.14

@lovrabet/rabetbase-cli@2.3.14

Developer CLI for Lovrabet apps, datasets, pages, SQL, BFF, database connections, skills, and AI agent workflows.

AI Security Review

scanned 28d ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

One or more suspicious static signals were detected.

Trigger

User runs `rabetbase project upgrade` and confirms, or supplies `--yes`/uses noninteractive mode.

Impact

May alter project-local agent skills/MCP entries and add a global Lovrabet skill.

Mechanism

User-invoked legacy AI-agent configuration migration and global skill installation.

Rationale

The obfuscation and user-invoked agent migration warrant a warning, but direct source inspection found no install hook or concrete malicious execution chain. The behavior is constrained to an explicit, normally confirmed Lovrabet migration.

Evidence

package.jsonlib/commands/project/index.jslib/commands/project/upgrade.jslib/utils/ai_config.jslib/skills/npx-skills-add.jslib/telemetry/cli-command-trace.jslib/constant/domain.js.lovrabet.cursor/rules/lovrabet_rules.mdc.claude/skills/lovrabet.cursor/mcp.json.rabetbase.json

Network endpoints4

@lovrabet/rabetbase-cli@2.3.14

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code