registry / @rtrentjones/greenlight / 0.8.0

@rtrentjones/greenlight@0.8.0

Greenlight CLI — setup and lifecycle for the harness.

AI Security Review

scanned 4h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

No blocking static signals were detected.

Trigger

User runs `greenlight agent sync`, deploy, verify, or secrets commands.

Impact

User-authorized project configuration changes and cloud/deployment actions.

Mechanism

Explicit CLI scaffolding, project-command execution, and provider API integration.

Rationale

Source shows an explicit deployment/scaffolding CLI, not malware. Its user-command agent configuration mutation warrants a warning under the stated policy.

Evidence

package.jsondist/bin.jsdist/chunk-N3IKUCSF.jsdist/chunk-C6NJHCRI.js.claude/skills/deploy-verify-promote/SKILL.md.mcp.jsonCLAUDE.md.greenlight

Network endpoints4

api.cloudflare.com/client/v4/user/tokens/verifyapi.vercel.com/v2/userapi.supabase.com/v1/projectsapp.terraform.io/api/v2/organizations

@rtrentjones/greenlight@0.8.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code