registry / @opendirectory.dev/skills / 0.1.96

@opendirectory.dev/skills@0.1.96

**Agent skills for founders who hate marketing.**

AI Security Review

scanned 3h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

No blocking static signals were detected.

Trigger

User runs the install command or confirms skills in the interactive browser.

Impact

Installed agent skills may later guide agent behavior; this is an explicit user-invoked extension capability.

Mechanism

Copies selected bundled skill directories and records a local manifest.

Rationale

This is a real AI-agent extension installation capability, but source inspection found it is explicit and user-consented rather than malicious install-time behavior.

Evidence

package.jsondist/index.jsdist/install-core.jsdist/uninstall-core.jsdist/update-core.jsdist/tui/browse.jsskills/<selected-skill>~/.claude/skills/<selected-skill>~/.codex/skills/<selected-skill>~/.opendirectory/installed.json

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence with false-positive risk.

@opendirectory.dev/skills@0.1.96

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code