registry / alnair / 0.1.1

alnair@0.1.1

Give AI agents secure, temporary permissions — alnair init

AI Security Review

scanned 21h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

No blocking static signals were detected.

Trigger

User runs `alnair init`.

Impact

Agents may be instructed to request capabilities automatically before privileged actions.

Mechanism

Project-scoped AI-agent configuration and hook installation.

Rationale

Source inspection found a real explicit-user-command AI-agent control-surface mutation, warranting a warning under policy. It found no concrete install-time malicious chain, remote payload execution, credential theft, or destructive behavior.

Evidence

package.jsondist/bin.jsdist/init.jsdist/backend.jsdist/detect.jsdist/integrations/agents-md.jsdist/integrations/codex.jsdist/integrations/cursor.jsdist/integrations/claude-hooks.jsdist/integrations/hooks.js.alnair/config.json.gitignore.codex/config.toml.mcp.jsonAGENTS.mdCLAUDE.md.claude/settings.json.claude/hooks/alnair-grant.mjs

alnair@0.1.1

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code