registry / annotron / 0.5.0

annotron@0.5.0

Local, browser-based review editor for agent-generated HTML artifacts — annotate elements and text, send feedback to your AI coding agent, then finalize the result into the file and download it.

AI Security Review

scanned 2h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. This is a first-party Claude plugin extension that can widen agent permissions after an explicit user prompt and register a cancellation hook. No unconsented install-time mutation, remote payload retrieval, or credential exfiltration was found.

Static reason

No blocking static signals were detected.

Trigger

User approves first-time setup or activates the Claude plugin, then uses the annotron CLI.

Impact

Broadens permitted agent shell/read operations and can deny agent tool calls while a local review session is cancelled.

Mechanism

User-approved Claude permission grants plus a local PreToolUse cancellation hook.

Rationale

No concrete malicious chain was found. Per policy, the user-approved Claude permission mutation and PreToolUse control hook remain a guarded agent-extension lifecycle risk that should be warned rather than blocked.

Evidence

package.jsonbin/annotronsrc/server.jshooks/hooks.jsonhooks/annotron-cancel-check.shskills/annotron-review/SKILL.md.claude/settings.json<artifact>.annotron.json.annotron-uploads/

Network endpoints2

127.0.0.1:7321$host:$port/cancel-check

annotron@0.5.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code