registry / @passioncode-ai/fabric-agent-adapter / 0.34.1
@passioncode-ai/fabric-agent-adapter@0.34.1
Create Fabric-compatible agents, run them as always-alive local services with dashboards (fabric-service/0.1), and adapt existing projects to the Fabric Agent Contract. This package is the installer CLI.
AI Security Review
scanned 20d ago · by lpm-firewall-aiThe manifest has no install hook, and the flagged CLI writes are tied to an explicit user command. The flagged scripts perform identifier and profile validation; the plugin’s session behavior is scoped and gated.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Trigger
The installer runs when a user invokes its CLI; plugin hooks run after the user installs the Claude plugin.
Impact
No hostile or unconsented effect was established.
Mechanism
The CLI copies bundled skills into agent skill directories. The plugin hooks provide session information and use Fabric only under their stated conditions.
AI rationale
The manifest has no install hook, and the flagged CLI writes are tied to an explicit user command. The flagged scripts perform identifier and profile validation; the plugin’s session behavior is scoped and gated.
Decision evidence
public snapshotAI called this Clean at 96.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest declares only a test script and exposes the installer as a CLI; it has no install lifecycle hook.
- The CLI copies bundled skills into an agent skills directory when invoked, and checks for an existing Claude plugin before handling Claude copies.
- The indicated plugin metadata location is read to detect an existing installation; it does not write configuration.
- The flagged identifier file normalizes URI identifiers, and the flagged profile file dispatches model and runner validation rules.
- The shipped session hooks are part of the Claude plugin, whose installation is shown as an explicit user command.
- The session hook code gates Fabric calls on its advertised feature and rejoins an existing session; host-hook setup is dry-run by default and requires an apply option.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork
Source & flagged code
6 flaggedbin/fabric-agent-adapter.jsView file
•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation.
#!/usr/bin/env node
'use strict';
const fs = require('fs');
const path = require('path');
const os = require('os');
const root = path.resolve(__dirname, '..');
const repo = 'passioncode-ai/fabric-agent-adapter';
const plugin_id = 'fabr
High
Trigger Reachable External Ai Agent Control Surface Mutation
Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.
bin/fabric-agent-adapter.jsView on unpkg13L14: const fs = require('fs');
L15: const path = require('path');
Medium
Dynamic Require
Package source references dynamic require/import behavior.
bin/fabric-agent-adapter.jsView on unpkg · L13Findings
3 High6 Medium5 Low
HighTrigger Reachable External Ai Agent Control Surface Mutationbin/fabric-agent-adapter.js
HighSemantic Analysis Limitedplugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric-identifiers.mjs#virtual:normalized:round1
HighPrevious Version Dangerous Deltaplugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric-profiles.mjs
MediumDynamic Requirebin/fabric-agent-adapter.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistenceplugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric-service.mjs
MediumShips Build Helperplugins/fabric-agent-adapter/skills/creating-fabric-agents/scripts/check_dashboard_link.py
MediumStructural Risk Force Deep Review
LowScripts Present
Affected versions and remediation
This report applies to @passioncode-ai/fabric-agent-adapter@0.34.1.
See all versions of @passioncode-ai/fabric-agent-adapter for other recorded verdicts.
- Review the evidence and your use of @passioncode-ai/fabric-agent-adapter@0.34.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.