registry / @lovrabet/rabetbase-cli / 2.4.3

@lovrabet/rabetbase-cli@2.4.3

Developer CLI for Lovrabet apps, datasets, pages, SQL, BFF, database connections, skills, and AI agent workflows.

AI Security Review

scanned 23d ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. npm installation automatically launches a global rabetbase AI-skill installation. This is a first-party agent-extension lifecycle action, but no confirmed exfiltration or foreign control-surface mutation was found.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm postinstall

Impact

Adds or refreshes the rabetbase skill in common agent skill directories and delegates installation to npx.

Mechanism

spawns the Skills CLI to install a global packaged skill

Rationale

The package has a real postinstall side effect that installs a globally discoverable AI-agent skill. Policy classifies first-party package-owned agent extension setup as warn absent a concrete malicious chain.

Evidence

package.jsonscripts/postinstall.mjslib/postinstall.jslib/skills/builtin-skill.jslib/skills/npx-skills-add.jslib/skills/skill-presence.jsskills/rabetbase.manifest.jsonskills/rabetbase/~/.agents/skills/rabetbase~/.claude/skills/rabetbase

Decision evidence

public snapshot

with false-positive risk.

@lovrabet/rabetbase-cli@2.4.3

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code