registry / @lucasfelipe23/specway / 1.3.0

@lucasfelipe23/specway@1.3.0

Agent-ready starter kit: spec-driven + TDD methodology with discoverable skills and a consistency checker.

AI Security Review

scanned 5h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

No blocking static signals were detected.; source closely matched a different package identity

Trigger

User runs specway init, adopt, or upgrade in a target project.

Impact

A user-authorized project configuration change enables local metadata to be shown at Claude session start.

Mechanism

Explicit project scaffolding installs a local agent-session context hook.

Rationale

This is not concrete malicious behavior, but it is an explicit-user-command AI-agent configuration mutation. Under the firewall policy, that warrants a warning rather than a block.

Evidence

package.jsonbin/specway.mjs.claude/settings.jsonscripts/session-context.mjs.specs/config.md.specs/memory/log.md

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

bin/specway.mjs explicitly scaffolds .claude/settings.json into the caller's project.

@lucasfelipe23/specway@1.3.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code