registry / create-snipara / 2.0.13

create-snipara@2.0.13

Onboard Snipara Hosted MCP Context + Memory with auth, companion workflows, and optional Snipara Sandbox

AI Security Review

scanned 3h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. The CLI is an explicit project-onboarding tool that writes Snipara MCP and agent-integration configuration. Optional Claude Code hooks execute the separately installed Snipara companion during agent lifecycle events. No unconsented install-time execution is present.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

User runs `create-snipara` or its `init` command and selects/configures an AI client.

Impact

Adds a Snipara-backed context workflow and can submit selected README/docs content to Snipara services during initialization.

Mechanism

Explicit project-scoped MCP, config, template, and optional agent-hook setup.

Rationale

The scanner's credential-exfiltration label is not substantiated by the inspected source: network use is Snipara-aligned onboarding and documented document sync. The explicit agent-hook/config setup still warrants a warning under the extension-lifecycle policy.

Evidence

package.jsondist/index.jsREADME.md.mcp.json.snipara/project.snipara/activation/manifest.json.snipara/companion/config.json.claude/hooks/*.claude/settings.json.env.env.local.env.example.agents/*/SKILL.md

Network endpoints4

/api/oauth/device/code

create-snipara@2.0.13

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code