registry / aireceipts-cli / 0.8.2

aireceipts-cli@0.8.2

Your AI coding agent just billed you. Here's the receipt.

AI Security Review

scanned 10d ago · by lpm-firewall-ai

No malicious install-time or import-time behavior is established. Runtime telemetry is disclosed on first use and has opt-out controls; agent settings mutation is limited to the explicit, confirmation-gated hook command.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User runs the CLI; hook mutation requires `aireceipts install-hook` and confirmation.

Impact

No confirmed attack behavior; telemetry sends limited diagnostics and explicit commands may write their documented local state/settings files.

Mechanism

Local receipt analysis with bounded telemetry and optional Claude Code hook setup.

Rationale

The package contains user-invoked CLI functionality, disclosed bounded telemetry, and a confirmation-gated first-party Claude Code hook installer. Source inspection found no install-time execution, credential exfiltration, remote payload execution, or unconsented control-surface mutation.

Evidence

package.jsondist/cli.jsdist/chunk-E3UCXX2P.jsdist/chunk-ES6XJOS2.jsdist/cli/commands/pr-check.js~/.aireceipts/state.json~/.aireceipts/telemetry.json~/.claude/settings.json~/.claude/settings.json.bak

Network endpoints2

eastus-8.in.applicationinsights.azure.com/v2/track/repos/

aireceipts-cli@0.8.2

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code