registry / @rsconcept/rstool / 1.0.0

@rsconcept/rstool@1.0.0

Agent-facing library for incremental RSForm construction, RSLang analysis, diagnostics, modeling, and evaluation. Wraps @rsconcept/domain with a deterministic session contract.

AI Security Review

scanned 16h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. No unconsented install-time attack is present. An explicit user/agent setup flow can register this package's first-party skill in a host project, extending agent behavior.

Static reason

No blocking static signals were detected.

Trigger

User asks an agent to install or enable the rstool skill after npm installation.

Impact

A package-provided instruction file can influence future agent workflows; no concrete exfiltration, destructive action, or stealth persistence was found.

Mechanism

First-party agent-skill registration plus local stdio session tooling.

Rationale

Source inspection found a first-party agent-extension setup path but no concrete malicious chain. Per policy, this lifecycle capability warrants a warning rather than a block.

Evidence

package.jsonskills/INSTALL.mdskills/rstool-helper/SKILL.mdsrc/wrapper/stdio-wrapper.tssrc/wrapper/client.tssrc/session/persistence.ts

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Benign with medium false-positive risk.

Evidence for warning

@rsconcept/rstool@1.0.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code