registry / @vivekyy/rudder / 0.2.1

@vivekyy/rudder@0.2.1

Record your AI coding prompts (Claude Code + Codex) and generate a daily digest of what you worked on.

AI Security Review

scanned 15h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

No blocking static signals were detected.

Trigger

User runs `rudder init`; later Claude/Codex hook events or user digest/dashboard commands activate capture and local agent execution.

Impact

User prompts and workspace metadata persist under `~/.rudder`; configured telemetry may transmit event metadata when enabled.

Mechanism

Explicit AI-agent config mutation, local prompt collection, and optional telemetry.

Rationale

No malicious install-time or stealth behavior is present, but the package deliberately mutates AI-agent configuration and captures prompts after an explicit user command. This is a real dual-use agent-control capability that warrants a warning rather than a block.

Evidence

package.jsondist/src/install.jsdist/src/hooks.jsdist/src/db.jsdist/src/agent.jsdist/src/telemetry.jsdist/src/serve.jsdist/bin/rudder.js~/.claude/settings.json~/.codex/config.toml~/.rudder/rudder.db~/.rudder/identity.json

Network endpoints2

127.0.0.1

@vivekyy/rudder@0.2.1

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code