registry / @stoop/cli / 0.3.1

@stoop/cli@0.3.1

Deploy static sites to stoop from the terminal.

AI Security Review

scanned 2h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. No install-time execution occurs. An explicit `stoop init <project>` command installs a remote Stoop skill and updates the selected project's agent instructions.

Static reason

One or more suspicious static signals were detected.

Trigger

User runs `stoop init`.

Impact

A remote, unpinned skill can influence coding agents in the chosen project after user invocation.

Mechanism

Explicit agent-extension setup via `npx skills add` plus `AGENTS.md` write.

Rationale

This is not concrete malicious behavior, but it performs an explicit, unpinned agent-skill installation and project instruction mutation. Treat it as a warning under the agent-extension lifecycle policy.

Evidence

package.jsondist/index.jsREADME.mdAGENTS.md.agents/skills/stoop/SKILL.md~/.config/stoop/config.json

Network endpoints1

stoop.run

Decision evidence

public snapshot

AI called this Suspicious at 89.0% confidence as Dangerous Capability with low false-positive risk.

@stoop/cli@0.3.1

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code