registry / @topolo/cli / 0.12.3

@topolo/cli@0.12.3

Public command-line interface for Topolo customer organizations, developers, and agents.

AI Security Review

scanned 13d ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. Installation prints instructions aimed at an AI assistant, directing it to continue onboarding automatically. The subsequent setup command can register a Topolo skill and MCP server in supported AI-agent hosts.

Static reason

One or more suspicious static signals were detected.

Trigger

npm postinstall emits the message; an assistant or user then runs topolo setup.

Impact

This can cause agent-extension configuration without a direct human decision at the later setup step; no confirmed credential export or remote payload execution was found.

Mechanism

The postinstall prompt encourages automatic command execution, and setup can modify supported agent integration surfaces.

AI rationale

The package contains an install-time AI-directed onboarding prompt paired with an agent-extension setup capability. This is a concrete lifecycle risk, but the setup action is not automatically executed by the hook itself.

Evidence

postinstall.mjsdist/index.js

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The package runs postinstall.mjs automatically after installation.
The install-time message instructs an AI assistant to automatically run setup and authentication commands.

@topolo/cli@0.12.3

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code