registry / @skaile/workspaces / 1.6.1

@skaile/workspaces@1.6.1

Skaile workspaces runtime — types, core, bridge, runner, store, connectors, and supporting layers as one publishable package

AI Security Review

scanned 3h ago · by lpm-firewall-ai

No unconsented install-time attack surface is established. Agent-control writes occur only when the user runs Skaile deployment commands and target explicit Skaile-supported paths.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User runs `skaile add`, `skaile install`, or another deployment command.

Impact

User-selected agent assets may be written to the selected local or global framework directory.

Mechanism

Explicit workspace asset deployment and pinned-source retrieval.

Rationale

The package is a workspace/agent deployment CLI with explicit user-command writes and pinned GitHub retrieval. No lifecycle execution, credential exfiltration, stealth persistence, or unconsented broad AI-agent control-surface mutation was found.

Evidence

package.jsondist/chunk-MENCWIHW.jsdist/chunk-F3HNW354.jsdist/chunk-STQOPWPS.jsdist/chunk-IEX5YV4R.jsdist/chunk-R7FOF242.js~/.claude/agents~/.codex/agents

Network endpoints2

github.comskaile.store

Decision evidence

public snapshot

@skaile/workspaces@1.6.1

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code