registry / @lovrabet/rabetbase-cli / 2.4.1

@lovrabet/rabetbase-cli@2.4.1

Developer CLI for Lovrabet apps, datasets, pages, SQL, BFF, database connections, skills, and AI agent workflows.

AI Security Review

scanned 25d ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. Installation automatically launches an external skills installer for the vendor's global rabetbase agent skill. This mutates a global agent-extension surface without an explicit user command.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm postinstall

Impact

Adds or updates agent instructions and introduces install-time remote dependency execution.

Mechanism

global first-party AI skill installation via npx

Rationale

This is an unconsented install-time global agent-extension setup with remote execution, but it is first-party and package-aligned rather than a concrete malicious chain. Warn rather than block under the install-control-surface policy.

Evidence

package.jsonscripts/postinstall.mjslib/postinstall.jslib/skills/builtin-skill.jslib/skills/npx-skills-add.jslib/skills/skill-presence.jsskills/rabetbase/SKILL.md

Decision evidence

public snapshot

AI called this Suspicious at 93.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

@lovrabet/rabetbase-cli@2.4.1

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code