registry / devrites / 3.0.2

devrites@3.0.2

DevRites — disciplined senior-engineer workflow skills pack for Claude Code and Codex

AI Security Review

scanned 22h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. Explicit installation adds DevRites skills, agents, AGENTS.md content, and Codex/Claude lifecycle hooks to the chosen project. It also installs a global helper binary by default.

Static reason

One or more suspicious static signals were detected.

Trigger

User runs npx devrites or an install/update command.

Impact

Installed hooks invoke devrites-engine during agent lifecycle events and can influence agent workflow.

Mechanism

Project-local AI-agent extension and hook installation

Rationale

This is not malicious, but its explicit installer configures project AI-agent hooks and a global helper binary. Per policy, first-party agent extension setup warrants a warning rather than a block.

Evidence

package.jsonbin/devrites.mjsengine/internal/install/install.goengine/internal/hostpack/hostpack.gopack/generated/codex/hooks.jsonpack/generated/claude/settings.json.agents/skills/.codex/agents/AGENTS.md.codex/hooks.json.claude/settings.json.claude/devrites.manifest~/.local/bin/devrites-engine

Network endpoints2

/ViktorsBaikers/DevRites/releases/download/

devrites@3.0.2

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code