registry / cyberaudit-skill / 3.2.0

cyberaudit-skill@3.2.0

Universal security audit skill for AI agents. Install once, audit any web or mobile app. OpenCode, Claude Code, Cursor, Kiro, Gemini — all supported.

AI Security Review

scanned 22h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

No blocking static signals were detected.

Trigger

User runs cyberaudit-skill install (or invokes its configured Cursor MCP entry).

Impact

Adds package-controlled audit instructions and a Cursor MCP server entry to agent control surfaces.

Mechanism

Explicit AI-agent extension and MCP configuration setup

Rationale

The package has no malicious npm lifecycle behavior, but its explicit installer alters AI-agent configuration and can persist an MCP entry. Policy classifies this user-command agent-control mutation as warn-level risk.

Evidence

package.jsondist/cli.jsdist/mcp-server.jsdist/scanners/secrets.jsdist/scanners/web.js~/.cursor/mcp.json~/.cursor/skills/cyberaudit~/.claude/skills/cyberaudit~/.codex/skills/cyberaudit./.cursor/mcp.json

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence with false-positive risk.

cyberaudit-skill@3.2.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code