registry / aireceipts-cli / 0.5.0

aireceipts-cli@0.5.0

Your AI coding agent just billed you. Here's the receipt.

AI Security Review

scanned 10d ago · by lpm-firewall-ai

No confirmed malicious attack surface. The package has user-invoked CLI features for local AI usage analysis, optional Claude hook setup, telemetry, and PR publishing.

Static reason

No blocking static signals were detected.

Trigger

User runs aireceipts commands; hook mutation requires aireceipts install-hook and confirmation.

Impact

No install-time execution, credential exfiltration, stealth persistence, remote payload loading, or unconsented broad agent-control mutation found.

Mechanism

Explicit CLI commands read local agent data and perform declared telemetry or PR integrations.

Rationale

Static source inspection finds no malicious chain. Network and filesystem actions are package-aligned, command-gated, and the only AI-agent settings mutation is explicitly confirmed by the user.

Evidence

package.jsondist/cli.jsdist/chunk-IUQKZ7WU.jsdist/chunk-GOROTR2G.jsdist/cli/commands/pr-check.jsdist/cli/commands/pr.js

Network endpoints3

eastus-8.in.applicationinsights.azure.com/v2/trackapi.github.com/repos/${baseRepo}/issues/${pr}/commentsgithub.com/${pr.ownerRepo}.git

aireceipts-cli@0.5.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code