registry / @veedubin/neuralgentics / 0.14.0

@veedubin/neuralgentics@0.14.0

Neuralgentics OpenCode plugin — agent personas, skills, routing enforcement, and MCP tools.

AI Security Review

scanned 2h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. Explicit CLI setup installs a first-party OpenCode agent extension and writes agent configuration. It can also launch third-party UVX/NPX package installers and fetch GitHub release artifacts. No install-time execution or confirmed covert data-exfiltration chain was found.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User runs `neuralgentics init`, `--init-project`, `--init-homedir`, or update commands.

Impact

Installed agent profiles have broad tool permissions; external dependencies or fetched configuration may execute in the user's agent environment.

Mechanism

User-invoked OpenCode configuration deployment plus external package/bootstrap execution.

Rationale

Warn because this is an explicit user-invoked AI-agent extension installer that deploys broad-permission profiles and executes external package bootstrap commands. It is not malicious: no npm install hook, covert exfiltration, or concrete attack behavior was established.

Evidence

package.jsondist/neuralgentics/init.jsdist/neuralgentics/install-packages.jsdist/neuralgentics/download.jsdist/server.js.opencode/agents/orchestrator.md.opencode/skills/external-skills-fetcher/SKILL.md.opencode/opencode.json.opencode/agents/.opencode/skills/AGENTS.md~/.cache/neuralgentics/version_cache.json

@veedubin/neuralgentics@0.14.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code