registry / ccbrief / 0.2.0

ccbrief@0.2.0

A minimal, configurable status line for Claude Code.

AI Security Review

scanned 9d ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

No blocking static signals were detected.

Trigger

User runs `ccbrief init` (and subsequently Claude Code invokes the configured status line).

Impact

Claude Code settings can be changed to run the package renderer; the renderer reads stdin/config and invokes local git commands.

Mechanism

Explicit Claude Code statusLine configuration and local renderer deployment.

Rationale

This is an explicit-user-command mutation of an AI-agent configuration surface, which warrants a warning under the stated policy. Source inspection found no concrete malicious chain or install-time execution.

Evidence

package.jsonbin/ccbrief.jssrc/commands/init.jssrc/commands/uninstall.jssrc/paths.jssrc/statusline.js$CLAUDE_CONFIG_DIR/settings.json$HOME/.claude/settings.json$CLAUDE_CONFIG_DIR/ccbrief/config.json$CLAUDE_CONFIG_DIR/ccbrief/statusline.js$CLAUDE_CONFIG_DIR/ccbrief/package.json

ccbrief@0.2.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code