registry / @nebulacomponents/citable / 1.1.0

@nebulacomponents/citable@1.1.0

Production-grade SEO, AEO, and GEO agent skill with auditable detection, claim governance, evidence validation, and multi-agent installation.

AI Security Review

scanned 11h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. No malicious install-time or import-time attack surface is confirmed. The explicit installer can place this package's own skill bundle in selected AI-agent skill directories.

Static reason

No blocking static signals were detected.

Trigger

User runs `citable install` or `citable update` and confirms or passes `--yes`.

Impact

Installed skill content may influence supported agent workflows after user-authorized setup.

Mechanism

Explicit first-party AI-agent skill installation with scoped file copying.

Rationale

Source inspection found an intentional, user-invoked multi-agent skill installer but no concrete malicious chain. Per policy, first-party package-owned agent extension setup warrants a warning rather than a block.

Evidence

package.jsoncli/bin/citable.jssrc/installer/index.jssrc/installer/providers.jssrc/crawler/fetch.jsskill/SKILL.mddist/universal.agents/skills/citable.claude/skills/citable

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Dangerous Capability with medium false-positive risk.

@nebulacomponents/citable@1.1.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code