registry / @puzzmo/cli / 1.0.59

@puzzmo/cli@1.0.59

Command-line tool for Puzzmo game developers. Authenticate, upload game builds, and create new game projects.

AI Security Review

scanned 4h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. No install-time malicious behavior is established. Explicit game creation can configure a Puzzmo MCP server and explicit migration can feed remote MCP instructions to a locally installed AI agent with project-directory access.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User runs `puzzmo game create` or `puzzmo migrate` and selects an agent/workflow.

Impact

A configured agent may modify the selected project according to MCP-delivered instructions; the default MCP configuration can include the saved Puzzmo token.

Mechanism

First-party MCP configuration plus remote-prompt-driven local AI-agent execution.

Rationale

The package is not malicious by static inspection, but its explicit MCP/agent orchestration and token-bearing project configuration create a meaningful first-party agent-extension risk. Downgrade to warn rather than block because there is no unconsented install-time mutation or concrete malicious chain.

Evidence

package.jsonsrc/index.tssrc/commands/game/create.tssrc/skills/runner.tssrc/skills/mcp-client.tssrc/agents/stream-json-cli.tssrc/util/api.tssrc/util/exec.tsproject/.mcp.jsonproject/.gitignoreproject/.gitproject/.puzzmo/config.json

Network endpoints3

@puzzmo/cli@1.0.59

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code