registry / @outputease/toolkit / 0.3.1

@outputease/toolkit@0.3.1

Batteries-included CLI that scaffolds development projects with first-class AI-assisted development support

AI Security Review

scanned 4h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

No blocking static signals were detected.

Trigger

User runs an outputease CLI command, especially `agents apply`, `init`, or `update`.

Impact

Can alter selected project AI-agent files or requested user-global MCP configuration.

Mechanism

Explicit CLI-driven runtime bootstrap and agent-configuration generation.

Rationale

No concrete malicious behavior was found, but the package intentionally manages AI-agent and MCP configuration and can bootstrap external tooling from its CLI. This merits a warning under the stated control-surface policy, not a block.

Evidence

package.jsonbin/_launcher.cjssrc/agents/apply.tssrc/agents/generate.tssrc/cli/commands/agents/index.tssrc/update/fetch.ts~/.codex/config.toml~/.codeium/windsurf/mcp_config.json.codex/config.toml.claude/.mcp.json.specify/

Network endpoints2

bun.sh/installregistry.npmjs.org/@outputease/toolkit/latest

@outputease/toolkit@0.3.1

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code