registry / @nebulacomponents/citable / 1.4.0

@nebulacomponents/citable@1.4.0

Production-grade SEO, AEO, and GEO agent skill with auditable detection, claim governance, evidence validation, and multi-agent installation.

AI Security Review

scanned 6h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. No install-time execution is present. Explicit `citable install`/`update` can copy this package's skill bundle into selected coding-agent skill directories; explicit observation and upgrade commands perform network actions.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User runs `citable install`, `update`, `observe`, or `self-upgrade`.

Impact

Installed skill content may influence supported coding-agent workflows; no unconsented persistence, credential exfiltration, or remote payload execution was confirmed.

Mechanism

User-invoked agent-skill installation plus bounded audit and npm-update networking.

Rationale

This is not concrete malicious behavior, but its explicit multi-agent skill installation is a meaningful agent-extension lifecycle capability. Per policy, retain a warning rather than block because activation is user-invoked and package-owned.

Evidence

package.jsoncli/bin/citable.jssrc/installer/index.jssrc/installer/providers.jssrc/commands/selfUpgrade.jssrc/commands/observe.jssrc/crawler/fetch.jsdist/universal.claude/skills/citable.agents/skills/citable.cursor/skills/citable

Network endpoints3

@nebulacomponents/citable@1.4.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code