registry / @ric-infra/harness / 0.1.3

@ric-infra/harness@0.1.3

Protocol-first, evidence-gated workflow harness for Codex and other agent executors.

AI Security Review

scanned 7h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. No confirmed malicious attack surface was established. An explicit CLI setup action installs first-party Codex configuration and lifecycle hooks into the target project.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User runs `ric-harness init` or `ric-harness codex install`.

Impact

Can modify the selected project's Codex control files and append sanitized hook events to a local runtime log.

Mechanism

Explicit first-party Codex extension and local lifecycle-metadata setup.

Rationale

This is not malicious by source evidence, but it is a user-invoked first-party AI-agent extension lifecycle capability that modifies project control surfaces. Per policy, retain a warn-level verdict rather than blocking publication.

Evidence

package.jsondist/src/cli/bin.jsdist/src/cli/index.jsdist/src/project/initializer.jsdist/src/project/codex-installer.jsdist/src/adapters/codex-executor.js.codex/hooks/harness-hook.mjsAGENTS.md.agents/skills.codex/config.toml.codex/hooks.json.codex/hooks/ric-harness-hook.mjs.runtime/hooks/events.jsonl

@ric-infra/harness@0.1.3

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code