registry / agentcfg / 0.1.11

agentcfg@0.1.11

基于 Git 的 AI 工具配置文件版本控制系统

AI Security Review

scanned 18h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User runs `agentcfg init`, then configured agent tool events occur.

Impact

Changes `~/.claude`, `~/.cursor`, `~/.codex`, or project `.opencode` configuration and creates Git history of tracked configuration files.

Mechanism

Explicit AI-agent hook installation and automatic local Git snapshots.

Rationale

Not malicious: source shows no lifecycle-triggered mutation or concrete theft/execution behavior. Warn because explicit setup persistently modifies AI-agent control surfaces and auto-commits their configuration.

Evidence

package.jsonbin/agentcfg.jssrc/install.jssrc/core/commit.jssrc/hooks/claude.jssrc/hooks/codex.jssrc/hooks/cursor.jssrc/hooks/opencode.jssrc/ui/server.js~/.claude/settings.json~/.cursor/hooks.json~/.codex/hooks.json~/.codex/config.toml.opencode/plugins/agentcfg.ts

agentcfg@0.1.11

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code