registry / @nstechhub/corporate-ns-flow-kit / 1.6.1

@nstechhub/corporate-ns-flow-kit@1.6.1

Agent-Driven Lifecycle Kit para sistemas legados — agentes executam, humanos decidem.

AI Security Review

scanned 11h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. The package is an explicit CLI-driven Claude/AI-agent kit installer. Its user-invoked setup can copy agent instructions and register MCP servers in project or user Claude configuration; no install-time trigger exists.

Static reason

No blocking static signals were detected.

Trigger

User runs `ns-flow-kit init`, `setup-mcp`, or `install-plugin`.

Impact

User-approved configuration can enable configured MCP integrations and optional API/git access.

Mechanism

Explicit agent-extension and MCP configuration setup.

Rationale

Source inspection found no lifecycle execution or covert exfiltration, but the package has explicit user-command AI-agent control-surface mutations. Under the firewall policy, this is a warn-level agent-extension lifecycle risk rather than a publish-block malicious package.

Evidence

package.jsonbin/cli.jsplugins/ns-flow-aws/install.jsplugins/ns-flow-azure-cloud/install.jsplugins/ns-flow-movidesk/install.jsplugins/ns-flow-movidesk/lib/movidesk-client.jsplugins/ns-flow-obsidian-mind/install.js.claude/agents.claude/commandsCLAUDE.md.claude/.local-config.json.mcp.json~/.claude.json~/.claude/agents~/.claude/commands

@nstechhub/corporate-ns-flow-kit@1.6.1

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code