registry / akapen / 0.3.0

akapen@0.3.0

AkaPen markdown review editor for local browser use

AI Security Review

scanned 5h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

No blocking static signals were detected.

Trigger

User runs akapen --install-skill (optionally with --force).

Impact

Adds project-scoped agent instructions that can influence later Claude Code sessions.

Mechanism

Copies bundled AI-agent skill files into the current project.

Rationale

The package is not malicious: it has no install hook and no concrete exfiltration or remote-code-execution chain. Per policy, its explicit command that mutates an AI-agent control surface warrants a non-blocking warning.

Evidence

package.jsondist/cli.jsdist/server/lib/install-skill.jsskills/akapen/SKILL.mddist/server/lib/license.jsdist/server/server.jsdist/server/routes.js.claude/skills/akapen

Network endpoints1

api.polar.sh/v1/customer-portal/license-keys

Decision evidence

public snapshot

akapen@0.3.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code