registry / create-lean-agent-kit / 1.0.0

create-lean-agent-kit@1.0.0

Lean core memory kit for AI coding agents — map-first context, convention checks, optional packs for specs/stacks/guardrails.

AI Security Review

scanned 7h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. The CLI copies local templates into a user-selected project when explicitly run. Packaged agent instructions can configure Cursor/Claude project integrations, including optional Cursor session prompts. No exfiltration or remote execution is established.

Static reason

No blocking static signals were detected.

Trigger

Explicit execution of `create-lean-agent-kit` and subsequent explicit `leanagentkit-wire-agent` use

Impact

Can add `.agent` content and, through the agent setup workflow, project-local Cursor/Claude control files.

Mechanism

User-invoked project scaffolding and AI-agent integration setup

Rationale

Source inspection found no install-time execution, network endpoint use, credential collection, remote payload loading, or destructive behavior. Warn because the package intentionally supports project-local AI-agent configuration and session-hook setup.

Evidence

package.jsonbin/cli.mjstemplate/core/.agent/skills/leanagentkit-wire-agent.mdtemplate/core/.agent/install/cursor/hooks.jsontemplate/core/.agent/install/cursor/rules/memory.mdctemplate/core/.agent/install/claude/CLAUDE.md<target>/.agent/**<target>/.leanagentkit-backup/**<target>/.cursor/**<target>/.claude/**

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

`bin/cli.mjs` explicitly scaffolds AI-agent files into the chosen target.
`template/core/.agent/skills/leanagentkit-wire-agent.md` directs creation of `.cursor` and `.claude` integration files.
`template/core/.agent/install/cursor/hooks.json` defines session-start and session-end agent prompts.

Evidence against

`package.json` has only `prepare: husky`; no preinstall/install/postinstall hook.
`bin/cli.mjs` uses local filesystem operations only; no network, shell, eval, env harvesting, or payload loading.
Cursor hooks say not to auto-commit or auto-push, and wire-agent describes consent/opt-in handling.

Behavioral surface

Source

Filesystem

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 22.1 KB of source

Source & flagged code

3 flagged

bin/cli.mjsView file

•Published source reference

Medium

Ai Review Evidence

`bin/cli.mjs` explicitly scaffolds AI-agent files into the chosen target.

bin/cli.mjsView on unpkg

template/core/.agent/skills/leanagentkit-wire-agent.mdView file

•Published source reference

Medium

Ai Review Evidence

`template/core/.agent/skills/leanagentkit-wire-agent.md` directs creation of `.cursor` and `.claude` integration files.

template/core/.agent/skills/leanagentkit-wire-agent.mdView on unpkg

template/core/.agent/install/cursor/hooks.jsonView file

•

Source & flagged code

3 flagged · loading source

bin/cli.mjsView file

•Published source reference

Medium

Ai Review Evidence

`bin/cli.mjs` explicitly scaffolds AI-agent files into the chosen target.

bin/cli.mjsView on unpkg

template/core/.agent/skills/leanagentkit-wire-agent.mdView file

•Published source reference

Medium

Ai Review Evidence

`template/core/.agent/skills/leanagentkit-wire-agent.md` directs creation of `.cursor` and `.claude` integration files.

template/core/.agent/skills/leanagentkit-wire-agent.mdView on unpkg

template/core/.agent/install/cursor/hooks.jsonView file

Findings

3 Medium4 Low

MediumAi Review Evidencebin/cli.mjs

MediumAi Review Evidencetemplate/core/.agent/skills/leanagentkit-wire-agent.md

MediumAi Review Evidencetemplate/core/.agent/install/cursor/hooks.json

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LPM CLI

•

Published source reference

Medium

Ai Review Evidence

`template/core/.agent/install/cursor/hooks.json` defines session-start and session-end agent prompts.

template/core/.agent/install/cursor/hooks.jsonView on unpkg

Runtime surface

package.json

Entrypointsbin → create-lean-agent-kit

Runtimenode >=24.16.0pnpm >=9

Artifact581 KB · 154 files1 signature(s) · provenance

Install lifecycleprepare

Behavioral surface

FilesystemHighEntropyStringsManifest: clean

Source & flagged code

3 flagged

bin/cli.mjsView file

•Published source reference

Medium

Ai Review Evidence

`bin/cli.mjs` explicitly scaffolds AI-agent files into the chosen target.

bin/cli.mjsView on unpkg

template/core/.agent/skills/leanagentkit-wire-agent.mdView file

•Published source reference

Medium

Ai Review Evidence

`template/core/.agent/skills/leanagentkit-wire-agent.md` directs creation of `.cursor` and `.claude` integration files.

template/core/.agent/skills/leanagentkit-wire-agent.mdView on unpkg

template/core/.agent/install/cursor/hooks.jsonView file

•

Published source reference

Medium

Ai Review Evidence

`template/core/.agent/install/cursor/hooks.json` defines session-start and session-end agent prompts.

template/core/.agent/install/cursor/hooks.jsonView on unpkg