registry / @skaile/workspaces / 1.2.0

@skaile/workspaces@1.2.0

Skaile workspaces runtime — types, core, bridge, runner, store, connectors, and supporting layers as one publishable package

AI Security Review

scanned 3h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User runs Skaile CLI functionality that registers configured project plugins, or explicitly invokes `skaile integration install`.

Impact

A repository-controlled Skaile plugin declaration can cause its npm package code to execute with the invoking user's privileges.

Mechanism

Project-configured npm installation and dynamic plugin import; explicit project-local AI-agent integration setup.

Rationale

No concrete malicious install-time behavior, secret theft, or covert exfiltration was found. However, automatic dependency installation plus dynamic import from project configuration is a meaningful dangerous extension capability that warrants warning rather than a clean verdict.

Evidence

package.jsondist/plugin-store-3DAVGKHN.jsdist/cli/index.jsdist/ensure-sources-BQI2TOZZ.js

Decision evidence

public snapshot

AI called this Suspicious at 88.0% confidence as Dangerous Capability with low false-positive risk.

@skaile/workspaces@1.2.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code