@pellux/goodvibes-tui@2.0.18
Terminal-native GoodVibes client for coding, operations, knowledge and channel workflows; a pure client of the GoodVibes daemon.
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe postinstall hook automatically adds package-owned agent and skill files to the user's GoodVibes directory, so this warrants a warning for first-party agent-extension setup. The inspected deployment preserves existing entries and does not establish a concrete attack beyond that configuration change.
Decision evidence
public snapshot- The manifest runs scripts/postinstall.js during installation.
- Postinstall deploys bundled skills and agents into the user's GoodVibes directory.
- It copies missing bundled entries without replacing existing ones.
- Postinstall also places the package's GoodVibes instruction file in the user's home directory if it is absent.
- The deployed agent file is a package-owned code review agent.
- The install routine calls the bundled-file deployment function.
- The inspected deployment preserves existing agent and skill entries and only adds missing files.
Source & flagged code
10 flagged · loading sourcePackage defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgFindings
Affected versions and remediation
This report applies to @pellux/goodvibes-tui@2.0.18.
See all versions of @pellux/goodvibes-tui for other recorded verdicts.
- Review the evidence and your use of @pellux/goodvibes-tui@2.0.18 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.