registry / @yeshwanthyk/coding-agent / 0.4.3

@yeshwanthyk/coding-agent@0.4.3

Terminal-native coding agent with multi-provider support and extensible tooling.

AI Security Review

scanned 4h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. The optional Cockpit feature integrates with external AI-agent hook surfaces. Its generated hook stores received event data in Marvin's local spool; no network transmission is present in inspected source.

Static reason

No blocking static signals were detected.

Trigger

Run `marvin cockpit install`, or start the TUI with cockpit and autoRepair enabled.

Impact

External agent event payloads, including available prompt/message fields, can be copied to a local Marvin spool.

Mechanism

guarded AI-agent hook installation and local event capture

Rationale

The package is not malicious by source evidence, but its guarded external agent-hook lifecycle and local capture of hook payloads warrant a warning under the firewall policy.

Evidence

package.jsondist/adapters/cli/cockpit.jsdist/adapters/cli/cockpit/hook-template.jsdist/runtime/cockpit-autorepair.jsdist/adapters/tui/app.js~/.config/marvin/cockpit/events.jsonl

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Dangerous Capability with high false-positive risk.

@yeshwanthyk/coding-agent@0.4.3

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code