registry / @postplus/cli / 0.1.47

@postplus/cli@0.1.47

PostPlus CLI for PostPlus Cloud auth, status, and diagnostics.

AI Security Review

scanned 4h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

No blocking static signals were detected.

Trigger

User runs `postplus update` or `postplus uninstall`.

Impact

Can modify configured AI-agent skill surfaces with remotely sourced PostPlus skills.

Mechanism

User-invoked cross-agent skill installation/removal via npx.

Rationale

Source inspection found an explicit multi-agent skill mutation feature, which policy classifies as warn-level capability abuse. There are no lifecycle hooks or confirmed malicious behavior.

Evidence

package.jsonbuild/index.jsbuild/skill-management.jsbuild/skill-catalog.jsbuild/update-check.jsbuild/local-state.js

Network endpoints3

raw.githubusercontent.com/PostPlusAI/postplus-skills/main/skills/catalog.jsonregistry.npmjs.org/%40postplus%2Fcli/latestpostplus.io

@postplus/cli@0.1.47

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code