registry / agentcfg / 0.1.13

agentcfg@0.1.13

基于 Git 的 AI 工具配置文件版本控制系统

AI Security Review

scanned 18h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

No blocking static signals were detected.

Trigger

User runs `agentcfg init`; later AI tool events invoke the installed hooks.

Impact

Persistent hooks can stage and commit configuration-directory changes locally.

Mechanism

agent configuration hook installation and local Git auto-commit

Rationale

The package is not malicious by source evidence, but it deliberately persists broad AI-agent hooks and auto-commits local configuration changes after a user command. Per policy, this is a warn-level agent capability risk rather than a block.

Evidence

package.jsonbin/agentcfg.jssrc/install.jssrc/core/commit.jssrc/hooks/claude.jssrc/hooks/codex.jstemplates/hooks-claude.jsontemplates/plugin-opencode.ts~/.claude/settings.json~/.cursor/hooks.json~/.codex/hooks.json~/.codex/config.toml.opencode/plugins/agentcfg.ts.git

agentcfg@0.1.13

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code