registry / @markjaquith/agency / 2.71.27

@markjaquith/agency@2.71.27

Manage agentic work across repositories with durable workbases

AI Security Review

scanned 15d ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. On npm installation, the package installs a bundled Agency extension into Pi's global extension directory. That extension invokes the Agency CLI and can add Agency workbase instructions to Pi sessions.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

npm postinstall

Impact

Changes an AI-agent platform's extension surface without an explicit Agency command.

Mechanism

global Pi extension installation and runtime prompt augmentation

Rationale

This is a concrete automatic first-party AI-agent extension installation, so it warrants a lifecycle-risk warning. The inspected source limits it to the fixed Agency Pi extension and shows no malicious data or network behavior.

Evidence

package.jsonscripts/install-pi-extension.tspi-extensions/agency.tssrc/commands/integration.ts$HOME/.pi/agent/extensions/agency.ts

Decision evidence

public snapshot

AI called this Suspicious at 92.0% confidence as Benign with low false-positive risk.

Evidence for warning

postinstall automatically runs the Pi-extension installer.

@markjaquith/agency@2.71.27

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code