registry / @nojack/pocket-ui / 0.5.0

@nojack/pocket-ui@0.5.0

Scaffold a Next.js app preloaded with the Pocket UI kit — opinionated, agent-buildable UI (components + docs + AGENTS.md).

AI Security Review

scanned 16h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

No blocking static signals were detected.

Trigger

User runs `npx @nojack/pocket-ui [app-name]`.

Impact

AI coding tools opened in the generated project may follow the bundled UI workflow instructions.

Mechanism

Copies bundled template and project-local agent guidance.

Rationale

This is not concrete malware, but it explicitly writes project-local AI-agent instructions as part of scaffolding. Under the firewall policy, explicit user-command agent configuration mutation is warn-worthy rather than block-worthy.

Evidence

package.jsonbin/cli.mjstemplate/AGENTS.mdtemplate/app/api/brand/route.tstemplate/app/layout.tsxtemplate/package.jsontemplate/gitignoretemplate/npmrc

Network endpoints2

api.fontshare.comapi.fontshare.com/v2/css?f[]=general-sans@400,500,600&display=swap

@nojack/pocket-ui@0.5.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code