registry / @serovaai/ficta / 0.2.1

@serovaai/ficta@0.2.1

Keep your registered secrets out of the LLM — local redaction proxy for coding agents

AI Security Review

scanned 16h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User runs `ficta install` or launches an agent through `ficta`.

Impact

Can alter coding-agent launch configuration and process provider requests, including authentication-bearing traffic, within the declared redaction function.

Mechanism

Explicit agent-command shims and local proxy routing.

Rationale

The package has a real, explicit AI-agent control capability and reads agent configuration, so it warrants a warning under the firewall policy. Source inspection found no lifecycle activation, unconsented foreign control-surface mutation, or concrete exfiltration chain.

Evidence

package.jsonbin/ficta.mjsdist/cli.jsdist/install.jsdist/plugins/agents.jsdist/config.jsdist/server.jsdist/child-env.jsdist/plugins/doppler.js

Network endpoints5

api.anthropic.comapi.openai.comchatgpt.com

@serovaai/ficta@0.2.1

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code