registry / @zokizuan/satori-cli / 0.4.15

@zokizuan/satori-cli@0.4.15

Installer and doctor CLI for Satori's repo-aware MCP tools.

AI Security Review

scanned 17h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User runs `satori-cli install --client ...`.

Impact

Configured clients may start the installed Satori MCP runtime and receive forwarded environment variable names.

Mechanism

Explicit AI-client MCP configuration and launcher setup.

Rationale

This is not malicious, but its explicit install command modifies AI-agent control surfaces and can enable an MCP runtime. Per policy, that warrants a warning rather than a block.

Evidence

package.jsondist/index.jsdist/install.jsdist/managed-launcher-script.mjsdist/client.jsdist/local-diagnostics.js~/.satori/bin/satori-mcp.js~/.codex/config.toml~/.codex/skills/satori/SKILL.md~/.codex/AGENTS.md~/.claude.json~/.config/opencode/opencode.json

Decision evidence

public snapshot

@zokizuan/satori-cli@0.4.15

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code