registry / create-agentic-sql-app / 0.3.0

create-agentic-sql-app@0.3.0

A PostgreSQL-first starter generator for coding agents.

AI Security Review

scanned 16h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. The explicitly invoked generator writes a bundled Cursor agent definition and project templates into a user-selected output directory. It can then install generated-project dependencies and initialize Git, both user-selectable CLI behaviors. No confirmed exfiltration, remote payload execution, or install-time mutation was found.

Static reason

No blocking static signals were detected.

Trigger

User runs `create-agentic-sql-app <projectName>` and accepts or supplies generation options.

Impact

A generated project gains a writable Cursor agent and task prompts that influence later coding-agent sessions; this is a guarded agent-extension lifecycle risk rather than a concrete malicious chain.

Mechanism

Explicit CLI generation of project files, including a first-party Cursor agent configuration.

Rationale

Source establishes an explicit user-command, first-party agent-extension setup, which warrants a warning under the install-control-surface policy. It does not establish malicious behavior or a publish-blocking chain.

Evidence

package.jsondist/index.jsdist/generateProject.jsdist/copyTemplate.jsdist/installDependencies.jsdist/initializeGit.jstemplates/shared/.cursor/agents/tech-spec-architect.md

Decision evidence

public snapshot

create-agentic-sql-app@0.3.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code