registry / @lunarhue/revuiw / 0.7.0

@lunarhue/revuiw@0.7.0

Autonomous pull request UI reviews driven by Claude Code and Playwright MCP

AI Security Review

scanned 18h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User runs revuiw run and the Claude adapter executes.

Impact

The reviewed workspace is persistently trusted by Claude Code; configured commands and PR publishing can act with user-provided CI credentials.

Mechanism

writes ~/.claude.json workspace trust entry and spawns configured review commands

Rationale

The package is not malicious by source evidence, but it persistently mutates a foreign AI-agent trust configuration during an explicit command. Per policy, this warrants a warning rather than a publish block.

Evidence

package.jsondist/cli.jsdist/chunk-H74OMCYT.jsdist/chunk-BJIO3SIU.js~/.claude.json.revuiw/

Network endpoints3

api.github.com/repos/${context.repository}/issues/${context.pullRequestNumber}/commentsapi.github.com/repos/${context.repository}/pulls/${context.pullRequestNumber}/comments/repos/${context.repository}/pulls/${context.pullRequestNumber}/reviews

@lunarhue/revuiw@0.7.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code