registry / @passioncode-ai/fabric-agent-adapter / 0.51.1
@passioncode-ai/fabric-agent-adapter@0.51.1
Create Fabric-compatible agents, run them as always-alive local services with dashboards (fabric-service/0.1), and adapt existing projects to the Fabric Agent Contract. This package is the installer CLI.
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe package has no npm install lifecycle hook, and its CLI performs skill installation only when invoked. The flagged supervisor persistence supports the package’s local-service purpose, while the documented API key flow sends credentials to OpenRouter in Authorization.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Trigger
The CLI runs when a user invokes it; service setup occurs through explicit lifecycle operations described by the skill.
Impact
These operations can change the user’s skill files or establish a service that runs at login, consistent with the package’s documented purpose.
Mechanism
The CLI copies its own skills into user-level agent skill directories. The service kit can write and enable a service supervisor for a user-created service.
AI rationale
The package has no npm install lifecycle hook, and its CLI performs skill installation only when invoked. The flagged supervisor persistence supports the package’s local-service purpose, while the documented API key flow sends credentials to OpenRouter in Authorization.
Evidence
~/.agents/skills/<name>~/.claude/skills/<name>
Network endpoints1
openrouter.ai/api/v1/models
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json declares a CLI binary and no install, preinstall, or postinstall lifecycle hook.
- The installer’s file writes run inside its CLI main function when the command is invoked.
- The CLI copies the package’s skills into the user’s agent skills directory.
- The service kit’s supervisor functions support creating user services, matching the package’s stated local-service purpose.
- The OpenRouter connector sends its key in Authorization to the configured service and documents the official OpenRouter endpoint.
Evidence against
- The supervisor functions can enable services that restart at login, but the lifecycle guide describes them as explicit install or upgrade steps.
- The package includes agent skills and writes them to user-level skill directories when its installer is run.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork
Source & flagged code
6 flaggedbin/fabric-agent-adapter.jsView file
•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation.
#!/usr/bin/env node
'use strict';
const fs = require('fs');
const path = require('path');
c
High
Trigger Reachable External Ai Agent Control Surface Mutation
Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.
bin/fabric-agent-adapter.jsView on unpkg14L15: const fs = require('fs');
L16: const path = require('path');
Medium
Dynamic Require
Package source references dynamic require/import behavior.
bin/fabric-agent-adapter.jsView on unpkg · L14Findings
3 High6 Medium5 Low
HighTrigger Reachable External Ai Agent Control Surface Mutationbin/fabric-agent-adapter.js
HighSemantic Analysis Limitedplugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric-delegation.mjs#virtual:normalized:round1
HighPrevious Version Dangerous Deltaplugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric-supervisors.mjs
MediumDynamic Requirebin/fabric-agent-adapter.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistenceplugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric-supervisors.mjs
MediumShips Build Helperplugins/fabric-agent-adapter/skills/creating-fabric-agents/scripts/check_dashboard_link.py
MediumStructural Risk Force Deep Review
LowScripts Present
Affected versions and remediation
This report applies to @passioncode-ai/fabric-agent-adapter@0.51.1.
See all versions of @passioncode-ai/fabric-agent-adapter for other recorded verdicts.
- Review the evidence and your use of @passioncode-ai/fabric-agent-adapter@0.51.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.