registry / @lovrabet/rabetbase-cli / 2.3.15

@lovrabet/rabetbase-cli@2.3.15

Developer CLI for Lovrabet apps, datasets, pages, SQL, BFF, database connections, skills, and AI agent workflows.

AI Security Review

scanned 27d ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. Explicit skill installation invokes an external npx-based skill installer with global scope. Explicit project upgrade may alter Lovrabet-related agent/MCP artifacts after confirmation.

Static reason

One or more suspicious static signals were detected.

Trigger

User runs `rabetbase cli-skill install`, `rabetbase update`, or `rabetbase project upgrade`.

Impact

Can add or refresh Lovrabet agent guidance and remove legacy Lovrabet agent/MCP configuration.

Mechanism

user-invoked global agent-skill installation and legacy migration

Rationale

The source establishes a guarded, user-command agent-extension capability, not concrete malware behavior. Obfuscation and remote npx delegation justify a warning rather than a block.

Evidence

package.jsonlib/cli.jslib/commands/cli-skill/index.jslib/skills/npx-skills-add.jslib/commands/project/upgrade.jslib/utils/ai_config.js.codex/skills/lovrabet/SKILL.md.claude/skills/lovrabet/SKILL.md.cursor/mcp.json.lovrabet

Decision evidence

public snapshot

AI called this at 90.0% confidence with false-positive risk.

@lovrabet/rabetbase-cli@2.3.15

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code