registry / @semacode/cli / 2.0.0

@semacode/cli@2.0.0

Codex-native local semantic governance CLI for contracts, drift, impact, documentation gates, and code generation.

AI Security Review

scanned 2h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

No blocking static signals were detected.

Trigger

User runs `sema iniciar` or `sema sync-codex` in a project workspace.

Impact

Can influence AI-agent behavior in the chosen project; no exfiltration, remote payload, or unconsented install-time mutation found.

Mechanism

Explicit project-local AI-agent entrypoint generation and managed-block cleanup.

Rationale

Not malicious: source shows no install-time execution, network exfiltration, credential harvesting, or remote payload chain. Warn because explicit commands intentionally modify AI-agent instruction files across supported project-local agent surfaces.

Evidence

package.jsondist/index.jsdist/index.part08.jsdist/index.part06.jsdist/initCommand.jsdist/agentEntryPoints.jsdist/workspaceWrite.jsAGENTS.mddocs/syntax.mddocs/ai-workflow.mddocs/commands.md.clinerules/00-sema.md.github/copilot-instructions.md.cursor/rules/sema.mdc.claude/CLAUDE.md

@semacode/cli@2.0.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code