registry / @markjaquith/agency / 2.71.9

@markjaquith/agency@2.71.9

Manage agentic work across repositories with durable workbases

AI Security Review

scanned 15d ago · by lpm-firewall-ai

No confirmed malicious attack surface. The declared install hooks point to an absent script, while agent configuration writes are user-invoked workbase operations.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

npm lifecycle or explicit agency init/integration sync

Impact

No confirmed install-time mutation or data exfiltration.

Mechanism

missing lifecycle target; explicit project-local integration

Rationale

Direct inspection found no executable lifecycle installer in the packed source, so the declared hooks cannot establish the suspected agent-control mutation. Included agent integration is constrained to explicit workbase commands and validated context.

Evidence

package.jsonpi-extensions/agency.tssrc/commands/integration.tssrc/services/IntegrationService.ts

Decision evidence

public snapshot

AI called this Clean at 94.0% confidence as Benign with low false-positive risk.

Evidence for block

postinstall/preuninstall reference scripts/install-pi-extension.ts, but that path is absent from the package.

@markjaquith/agency@2.71.9

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code