registry / @slopus/rig / 0.2.16

@slopus/rig@0.2.16

Opinionated coding-agent harness with strong defaults for provider-aligned workflows.

AI Security Review

scanned 11h ago · by lpm-firewall-ai

No confirmed malicious attack surface. The package is a user-invoked coding-agent CLI that can consume provider credentials and run configured plugin workspace commands.

Static reason

No blocking static signals were detected.

Trigger

User runs the rig CLI or its explicit subcommands.

Impact

Provider credentials and workspace commands are handled only as runtime functionality; no automatic install-time mutation or exfiltration was established.

Mechanism

runtime coding-agent and plugin execution harness

Rationale

Source inspection found no lifecycle hook or automatic malicious chain. Credential and process capabilities are aligned with this CLI's declared agent-harness behavior and require runtime use.

Evidence

package.jsondist/main.jsdist/plugin-docker-bootstrap.jsdist/worklet-bootstrap.js.codex/auth.json

Decision evidence

public snapshot

AI called this Clean at 91.0% confidence as Benign with low false-positive risk.

Evidence for block

Runtime provider setup can read a Codex auth file.
The explicit `rig upgrade` command runs npm global install.

@slopus/rig@0.2.16

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code