registry / @passioncode-ai/fabric-agent-adapter / 0.5.6
@passioncode-ai/fabric-agent-adapter@0.5.6
Create Fabric-compatible agents, run them as always-alive local services with dashboards (fabric-service/0.1), and adapt existing projects to the Fabric Agent Contract. This package is the installer CLI.
AI Security Review
scanned 25d ago · by lpm-firewall-aiThe manifest has no install lifecycle hook, and the agent-directory writes occur through the explicitly invoked installer with overwrite guarded by --force. The inspected behavior is consistent with the package's skill installer purpose, with no confirmed attack surface.
Static reason
No blocking static signals were detected.
Trigger
A user runs the fabric-agent-adapter command.
Impact
It installs or updates agent skills in the user's home directory; no confirmed malicious behavior was found.
Mechanism
The command copies package skills to the selected user skill directory, skips existing destinations by default, and overwrites only with --force.
AI rationale
The manifest has no install lifecycle hook, and the agent-directory writes occur through the explicitly invoked installer with overwrite guarded by --force. The inspected behavior is consistent with the package's skill installer purpose, with no confirmed attack surface.
Evidence
~/.agents/skills~/.claude/skills
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json defines no lifecycle hook; it exposes the installer as a command-line executable.
- The inspected CLI checks whether its associated Claude plugin is installed before choosing behavior.
- The CLI writes package skills into user skill directories only when invoked, skips existing installs by default, and requires --force to overwrite them.
- The package source identifies its payload as skills for agent compatibility and setup.
Evidence against
Behavioral surface
CryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
CopyleftLicense
Source & flagged code
5 flaggedbin/fabric-agent-adapter.jsView file
•Runtime or CLI code links a write operation to an explicit external AI-agent control path:
backup = path.join(home, '.claude', 'sk[redacted]', `${name}-${date.now()}`);
fs.mkdirsync(path.dirname(backup), { recursive: true });
fs.renamesync(shadow, backup);
console.log(`removed shadowing ${info.issymboliclink() ? 'link' : 'copy'} ${shadow} (kept at ${backup})`);
removed += 1;
}
if (!removed) console.log('no shadowing copies found.');
}
function main(argv) {
const args = argv.slice(2);
if (args.includes('--help') || args.includes('-h')) {
usage();
return 0;
}
const force = args.includes('--force');
const prune = args.includes('--prune-shadow');
let target = 'agents';
const known = new set(['--force', '--prune-shadow']);
const unknown = [];
for (
High
External Ai Agent Control Surface Mutation
Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.
bin/fabric-agent-adapter.jsView on unpkg•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation.
#!/usr/bin/env node
'use strict';
const fs = require('fs');
const path = require('path');
const os = require('os');
const root = path.resolve(__dirname, '..');
const repo = 'passioncode-ai/fabric-agent-adapter';
const plugin_id = 'fabr
Findings
2 High3 Medium7 Low
HighExternal Ai Agent Control Surface Mutationbin/fabric-agent-adapter.js
HighTrigger Reachable External Ai Agent Control Surface Mutationbin/fabric-agent-adapter.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperplugins/fabric-agent-adapter/skills/creating-fabric-agents/scripts/check_dashboard_link.py
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowCopyleft License
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencebin/fabric-agent-adapter.js
Affected versions and remediation
This report applies to @passioncode-ai/fabric-agent-adapter@0.5.6.
See all versions of @passioncode-ai/fabric-agent-adapter for other recorded verdicts.
- Review the evidence and your use of @passioncode-ai/fabric-agent-adapter@0.5.6 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.