registry / agentic-content-pipeline / 0.1.0

agentic-content-pipeline@0.1.0

An agentic content pipeline: review-army loops, a deterministic tone gate, and a generation-side learner that feeds fixes back into future drafts.

AI Security Review

scanned 11h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. No install-time attack surface is present. Explicit CLI setup installs first-party skills and optionally registers agent definitions in consumer AI-agent directories; tone judging can POST supplied content to Gemini.

Static reason

One or more suspicious static signals were detected.

Trigger

User runs `agentic-content-pipeline` or `agentic-content-pipeline setup`; agent registration additionally requires `--harness`.

Impact

Modifies consumer project AI-agent configuration and can execute npm dependency installation; no unconsented lifecycle execution was found.

Mechanism

Explicit setup copies skills, seeds agent memory, installs bundled script dependencies, and optionally registers Claude/Codex agents.

Rationale

Source inspection confirms explicit, package-aligned agent setup and optional Gemini evaluation rather than stealth or install-time compromise. Warn because default CLI setup mutates AI-agent skill directories and performs runtime dependency installation.

Evidence

package.jsonbin/acp.mjsskills/content-pipeline/scripts/setup.tsskills/content-pipeline/scripts/package.jsonskills/human-tone/scripts/eval/judge.ts<consumer-repo>/.claude/skills/content-pipeline<consumer-repo>/.claude/skills/human-tone<consumer-repo>/.claude/agent-memory<consumer-repo>/.claude/agents<consumer-repo>/.codex/agents<consumer-repo>/content-pipeline.config.json

agentic-content-pipeline@0.1.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code