registry / @sleekai/cortex / 2.1.0

@sleekai/cortex@2.1.0

Cortex — AI Compute Operating System: capability-planned, budget-capped, harness-agnostic dispatch kernel (UCP v2)

AI Security Review

scanned 3h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

No blocking static signals were detected.

Trigger

User runs cortex-install-skill, cortex dispatch, or the cortex_dispatch MCP tool.

Impact

Can alter configured agent behavior and execute configured workers/project hooks with the invoking user's permissions.

Mechanism

User-invoked agent configuration, model-worker dispatch, patching, and hook execution.

Rationale

This is not concrete malware, but its explicit AI-agent configuration mutation and model-driven code execution are dangerous capabilities that warrant a warning under the policy.

Evidence

package.jsonskills/install.jsdist/harness/http-harness.jsdist/harness/cli-harness.jsdist/validator/patch-apply.jsdist/mcp-server.js~/.config/opencode/skills/cortex~/.claude/skills/cortex~/.agents/skills/cortex~/Library/Application Support/Claude/claude_desktop_config.json~/.config/opencode/opencode.jsonc<project>/.cortex/<project>/package.json<project> source files

@sleekai/cortex@2.1.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code