registry / @sleekai/cortex / 2.0.1

@sleekai/cortex@2.0.1

Cortex — AI Compute Operating System: capability-planned, budget-capped, harness-agnostic dispatch kernel (UCP v2)

AI Security Review

scanned 3h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User explicitly invokes cortex-install-skill.

Impact

Adds a package-owned agent skill and local MCP server entry; dispatch can later invoke configured workers and apply their patches.

Mechanism

AI-agent skill and MCP configuration setup

Rationale

Not malicious by source inspection: no lifecycle-triggered mutation or concrete malicious chain was found. Warn because the explicit installer modifies AI-agent skill and MCP configuration.

Evidence

package.jsonskills/install.jsskills/cortex/SKILL.mdsrc/worker/registry.default.jsonsrc/harness/http-harness.tssrc/validator/patch-apply.ts$HOME/.claude/skills/cortex$HOME/.agents/skills/cortex$HOME/.config/opencode/skills/cortex$HOME/Library/Application Support/Claude/claude_desktop_config.json$HOME/.config/opencode/opencode.jsonc

@sleekai/cortex@2.0.1

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code