registry / ai-review-agent / 1.9.0

ai-review-agent@1.9.0

Local AI code review swarm — 15 observe-only default agents powered by Ollama, zero API costs (testgen opt-in)

AI Security Review

scanned 4d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. npm installation silently adds a Claude Code slash command to the user's global ~/.claude control surface. The injected command authorizes Bash invocations including package CLI, npm build, git, and Ollama commands.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm postinstall

Impact

Unconsented persistence and expansion of a foreign AI-agent command surface across Claude Code projects.

Mechanism

copies a package-supplied Claude command into the user's home configuration

Policy narrative

On npm postinstall, the package resolves the effective user's home directory, creates ~/.claude/commands, and installs its ai-review.md command without a user command or opt-in. That command is then available to every Claude Code project and grants agent tool permissions to execute package, npm, git, and Ollama commands. This is an unconsented install-time mutation of a foreign, broad AI-agent control surface.

Rationale

The lifecycle hook performs persistent global Claude Code command installation, which meets the firewall block boundary for unconsented postinstall mutation of a foreign/broad AI-agent control surface. Local-only LLM networking does not mitigate that install-time control-surface mutation.

Evidence

package.jsonscripts/postinstall.mjs.claude/commands/ai-review.mddist/core/llm/ollamaProvider.js~/.claude/commands/ai-review.md

ai-review-agent@1.9.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code