registry / @nojack/pocket-ui / 0.8.0

@nojack/pocket-ui@0.8.0

Scaffold a Next.js app preloaded with the Pocket UI kit — opinionated, agent-buildable UI (components + docs + AGENTS.md).

AI Security Review

scanned 16h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

No blocking static signals were detected.

Trigger

Explicit user invocation of the package CLI; generated app development mode for the brand route.

Impact

A coding agent opened in the generated project can follow the bundled instructions; no unconsented install-time mutation or concrete exfiltration chain was established.

Mechanism

User-invoked scaffold plus project-local AI-agent configuration files.

Rationale

This is a user-invoked agent-configuring scaffold, which warrants a warning under the install-control-surface policy. Source inspection found no concrete malicious behavior or unconsented install-time mutation.

Evidence

package.jsonbin/cli.mjstemplate/package.jsontemplate/AGENTS.mdtemplate/CLAUDE.mdtemplate/app/api/brand/route.tstemplate/app/layout.tsxtemplate/lib/theme/brand.ts

Network endpoints2

api.fontshare.comapi.fontshare.com/v2/css?f[]=general-sans@400,500,600&f[]=recia@400,500,600&display=swap

@nojack/pocket-ui@0.8.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code