registry / @markjaquith/agency / 2.16.0

@markjaquith/agency@2.16.0

Manage agentic work across repositories with durable workbases

AI Security Review

scanned 2h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User runs `agency integration sync` in an Agency workbase.

Impact

Creates `AGENTS.md` guidance and an OpenCode config allowing task and epic directories as external directories.

Mechanism

Explicit managed AI-agent configuration write

Rationale

This is a real but explicit first-party AI-agent configuration mutation, not concrete malware. Per policy, it warrants a warning rather than a publish block.

Evidence

package.jsonsrc/commands/integration.tssrc/services/IntegrationService.tssrc/workbase/agents-file.tssrc/workbase/opencode-file.tssrc/commands/work.tsAGENTS.md.opencode/opencode.jsoncopencodeclaude

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as with false-positive risk.

Dangerous Capability

low

Evidence for warning

`agency integration sync` explicitly writes managed `AGENTS.md` and `.opencode/opencode.jsonc`.
Generated OpenCode config grants `external_directory` access to workbase `tasks/*` and `epics/*`.
`agency work` explicitly locates and replaces itself with `opencode` or `claude`.

Evidence against

`package.json` has no preinstall, install, postinstall, or prepare lifecycle hook.
Integration writes require the explicit `integration sync` subcommand.
Existing symlinked or customized integration files are not overwritten.
Managed-file checksum validation limits updates to package-owned content.
No production HTTP client, credential harvesting, or exfiltration code was found.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystem

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 93 file(s), 496 KB of source, external domains: example.com, github.com, json-schema.org, opencode.ai

Source & flagged code

1 flagged

src/cli.test.tsView file

•matchType = previous_version_dangerous_delta matchedPackage = @markjaquith/agency@2.12.0 matchedIdentity = npm:QG1hcmtqYXF1aXRoL2FnZW5jeQ:2.12.0 similarity = 0.726 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/cli.test.tsView on unpkg

Source & flagged code

1 flagged · loading source

src/cli.test.tsView file

•matchType = previous_version_dangerous_delta matchedPackage = @markjaquith/agency@2.12.0 matchedIdentity = npm:QG1hcmtqYXF1aXRoL2FnZW5jeQ:2.12.0 similarity = 0.726 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/cli.test.tsView on unpkg

Findings

1 High1 Medium4 Low

HighPrevious Version Dangerous Deltasrc/cli.test.ts

MediumEnvironment Vars

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LPM CLI

Source & flagged code

1 flagged

src/cli.test.tsView file

•matchType = previous_version_dangerous_delta matchedPackage = @markjaquith/agency@2.12.0 matchedIdentity = npm:QG1hcmtqYXF1aXRoL2FnZW5jeQ:2.12.0 similarity = 0.726 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/cli.test.tsView on unpkg