registry / @lsproxy/cli / 1.0.1

@lsproxy/cli@1.0.1

Standalone refactor CLI driving any LSP server: project-wide rename, file-move with importer updates, and code actions.

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. Npm installation silently installs a package-owned Claude skill at `~/.claude/skills/lsproxy-cli`. That skill enables an AI agent to invoke this LSP/refactoring CLI, which can start configured LSP servers and write their workspace edits when the agent uses it. No concrete exfiltration, remote payload execution, or foreign broad control-plane mutation was found.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm postinstall; subsequently, an AI agent reads the installed skill or a user explicitly runs `lsproxy`.

Impact

Introduces an unprompted agent capability/instruction surface and can modify project files when invoked, but source inspection found no malicious chain.

Mechanism

postinstall copies a package-owned AI-agent skill; runtime executes configured LSP commands and applies guarded workspace edits.

Rationale

The package performs a real postinstall write to a user-wide AI-agent skill directory, warranting a warning under the lifecycle policy. The copied content and runtime source are package-aligned and show no concrete malicious behavior, so a publish block is not supported.

Evidence

package.jsonskillit-postinstall.cjsskills/lsproxy-cli/SKILL.mddist/connect.jsdist/session.jsdist/apply.jsdist/config/adapters/claude-code.jsdist/config/adapters/codex.js~/.claude/skills/lsproxy-cli~/.claude/settings.json~/.codex/config.toml

@lsproxy/cli@1.0.1

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code