registry / @steipete/summarize / 0.20.2

@steipete/summarize@0.20.2

Link → clean text → summary.

AI Security Review

scanned 8h ago · by lpm-firewall-ai

No confirmed malicious attack surface. The package can install a user-level daemon and Chrome bridge only after an explicit CLI command, and its model requests are part of requested summarization.

Static reason

No blocking static signals were detected.

Trigger

User runs `summarize daemon install --token <token>` or invokes a summarization/agent command.

Impact

Creates package-owned user daemon integration and sends requested content to the selected model provider.

Mechanism

User-invoked local daemon, native-messaging bridge, and configured LLM-provider requests.

Rationale

Source inspection found user-invoked, package-aligned daemon and model-provider functionality, not install-time or covert malicious behavior. The persistence and credential handling are explicit features with bounded local integrations.

Evidence

package.jsondist/cli.jsdist/esm/index.jsdist/esm/daemon/cli.jsdist/esm/daemon/systemd.jsdist/esm/daemon/native-messaging-install.jsdist/esm/daemon/native-messaging.jsdist/esm/daemon/env-snapshot.jsdist/esm/llm/cli-runners/codex.js

Decision evidence

public snapshot

AI called this at 95.0% confidence with false-positive risk.

@steipete/summarize@0.20.2

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code