registry / @skaile/workspaces / 1.3.0

@skaile/workspaces@1.3.0

Skaile workspaces runtime — types, core, bridge, runner, store, connectors, and supporting layers as one publishable package

AI Security Review

scanned 3h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User runs `skaile integration install`, starts a configured Skaile project, or invokes a configured agent driver.

Impact

Can add Skaile MCP/plugin configuration and execute user-configured project plugins; these actions are not install-time automatic.

Mechanism

Project-local agent configuration writes and configured plugin installation/dynamic import.

Rationale

Source inspection confirms explicit project-local agent integration and plugin-loading capabilities, not autonomous installation or exfiltration. Under the firewall policy, explicit user-command AI-agent configuration is warn-worthy rather than a publish block.

Evidence

package.jsondist/cli/index.jsdist/plugin-store-G4HKWCTU.jsdist/bridge/drivers/codex.jsdist/bridge/drivers/claude-sdk.js.claude/mcp.json.claude/settings.json.claude/plugins/skaile/.codex/skaile-session-instructions.md.skaile/plugins/package.json.skaile/plugins/node_modules/<configured-plugin>

@skaile/workspaces@1.3.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code