registry / ai-code-skills / 2.3.0

ai-code-skills@2.3.0

Agent Skills for Claude Code, Codex, and OpenCode that review code for security, performance, and clean code, then write one evidence-based Markdown report. Includes Next.js/React and Laravel/PHP pull-request reviewers, a stack-agnostic pre-push reviewer

AI Security Review

scanned 19h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. No install-time execution occurs. Explicit CLI installation replaces only this package's selected skill directories in supported agent skill locations; optional audit and delegation tools run only when invoked.

Static reason

No blocking static signals were detected.

Trigger

User runs ai-code-skills install, the SEO audit script, or delegate.sh.

Impact

Installed skills can influence supported AI-agent workflows; delegated prompts are sent to the user-selected external CLI.

Mechanism

Explicit agent-skill deployment and user-directed audit/delegation tooling.

Rationale

The package is not malicious by source evidence, but it intentionally modifies AI-agent extension directories when explicitly invoked. Per policy, this first-party agent extension setup warrants a warning rather than a block.

Evidence

package.jsonbin/cli.jsskills/delegate/scripts/delegate.shskills/technical-seo-geo-audit/scripts/lib/fetch.mjsskills/technical-seo-geo-audit/scripts/run.mjsskills/~/.claude/skills/<selected-skill>~/.agents/skills/<selected-skill>~/.config/opencode/skills/<selected-skill>

Network endpoints1

ai-code-skills@2.3.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code