registry / devez-vibe / 1.6.51

devez-vibe@1.6.51

Stable terminal UI for Codex and Claude Agent SDK

AI Security Review

scanned 1d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package automatically changes Codex and Claude user-level skill directories. It installs a package-supplied agent instruction set and removes files not present in that set.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm postinstall

Impact

The package changes broad AI-agent control surfaces without a separate user setup action.

Mechanism

automatic cross-agent skill deployment and pruning

Policy narrative

On npm installation, the postinstall script derives the user's Codex and Claude configuration locations, copies the bundled luna-loop skill into both, and prunes destination files missing from the package copy. This is an automatic mutation of broad, foreign AI-agent control surfaces; the absence of network activity does not remove the install-time control-surface risk.

Rationale

The package performs unconsented postinstall writes and deletions in both Codex and Claude user skill locations. This meets the install-control-surface policy for blocking.

Evidence

package.jsoninstall-skills.mjsskills/luna-loop/SKILL.mdskills/luna-loop$CODEX_HOME/skills/luna-loop$CLAUDE_CONFIG_DIR/skills/luna-loop~/.codex/skills/luna-loop~/.claude/skills/luna-loop

devez-vibe@1.6.51

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code