registry / @serviceme/devtools-core / 0.3.3

@serviceme/devtools-core@0.3.3

Reusable Node.js core capabilities powering the SERVICEME CLI and integrations.

AI Security Review

scanned 5h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

No blocking static signals were detected.

Trigger

A SERVICEME caller invokes skill linking, skill writing, or a scheduled-task executor.

Impact

A trusted caller can create agent/skill files or run configured commands; this is a dangerous capability rather than a covert package action.

Mechanism

Caller-controlled agent-file placement and task execution APIs.

Rationale

Not malicious by source inspection, but it exposes high-impact agent-control and execution capabilities to its consumers. Flag as a warning for downstream policy review.

Evidence

package.jsondist/skill-linker.jsdist/index.js.github/skills/<skillId>~/.agents/skills/<skillName>~/.agents/agents/<agentName>

Network endpoints2

localhost:3000/api/v1/marketplace/skillslocalhost:3000/api/v1/skills/validate

Decision evidence

public snapshot

@serviceme/devtools-core@0.3.3

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code