registry / @nebulacomponents/citable / 1.2.0

@nebulacomponents/citable@1.2.0

Production-grade SEO, AEO, and GEO agent skill with auditable detection, claim governance, evidence validation, and multi-agent installation.

AI Security Review

scanned 4h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. No automatic install-time attack is established. An explicit `citable install` can place the package-owned Citable skill into selected project or global AI-agent skill directories; `self-upgrade` contacts the npm registry only when invoked.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User runs `citable install`, `update`, or `self-upgrade`.

Impact

Installed skill content can influence supported agent workflows; no exfiltration, persistence beyond the managed skill, or unconsented lifecycle mutation was found.

Mechanism

Explicit AI-agent skill installation and optional npm-cache refresh.

Rationale

Not malicious by source evidence: the flagged behavior is user-invoked, scoped, and integrity-checked. Downgrade to warn because it installs an AI-agent skill payload into agent control surfaces.

Evidence

package.jsoncli/bin/citable.jssrc/cli/index.jssrc/installer/index.jssrc/installer/providers.jssrc/commands/selfUpgrade.jsdist/universal/.agents/skills/citable/dist/universal/.claude/skills/citable/dist/universal/.cursor/skills/citable/

Network endpoints1

registry.npmjs.org/@nebulacomponents%2Fcitable/latest

@nebulacomponents/citable@1.2.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code