registry / @slipalison/claupilot / 0.3.0

@slipalison/claupilot@0.3.0

Use your repository's GitHub Copilot customization (.github/copilot-instructions.md, instructions, prompts, agents, skills) from Claude Code and OpenCode — without committing a single tool-specific file.

AI Security Review

scanned 18h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. No unconsented npm install-time attack is present. When the user invokes the CLI or installs its Claude/OpenCode extension, it bridges repository AI-agent instructions into local tool configuration.

Static reason

No blocking static signals were detected.

Trigger

Explicit `claupilot` invocation or configured Claude/OpenCode session hook.

Impact

Repository-controlled instructions, prompts, agents, and skills can be surfaced to the selected coding-agent tool; this is the stated extension capability.

Mechanism

Project-local AI-agent customization bridge.

Rationale

Source inspection confirms an explicit, project-scoped agent-extension lifecycle capability but no concrete malicious behavior or install-time mutation. Flag as a warning under the extension-lifecycle policy.

Evidence

package.jsonhooks/hooks.jsonscripts/claupilot.mjsopencode/plugin/claupilot.js.claude/agents.claude/commands.claude/rules.claude/skills.opencode/agents.opencode/commands.opencode/skills.opencode/opencode.json.git/info/exclude

Decision evidence

public snapshot

@slipalison/claupilot@0.3.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code