registry / brickken-cli / 0.4.8

brickken-cli@0.4.8

Brickken CLI for x402-paid agentic transaction workflows

AI Security Review

scanned 12h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

No blocking static signals were detected.

Trigger

User runs `brickken skill install`, optionally with `--force`.

Impact

Modifies the selected Codex skills directory, affecting future agent instruction loading.

Mechanism

Explicit first-party AI-agent skill installation and overwrite.

Rationale

Source inspection confirms an explicit first-party Codex skill installer with overwrite capability, while lifecycle hooks and covert execution/exfiltration behavior are absent. Per policy, this agent configuration mutation warrants a warning rather than a block.

Evidence

package.jsondist/commands/skill.jsdist/internal/core/http.jsskills/brickken/SKILL.mdskills/brickken$CODEX_HOME/skills/brickken

Network endpoints3

api.sandbox.brickken.comapi.brickken.comforge.apigw.brickken.rocks/api

brickken-cli@0.4.8

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code