registry / dreative / 0.5.4

dreative@0.5.4

Frontend design skill for coding CLIs with typed planning, specialist treatments, verification, and an optional visual editor.

AI Security Review

scanned 15h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

No blocking static signals were detected.

Trigger

User runs `dreative install-skill --codex`.

Impact

Can steer Codex behavior for frontend work in that project.

Mechanism

explicit project AI-agent skill installation and instruction-file mutation

Rationale

Source inspection confirms a user-invoked project AI-agent control-surface write with an override instruction. The lack of lifecycle execution, remote exfiltration, and execution primitives makes blocking unwarranted, but the explicit config mutation merits a warning.

Evidence

package.jsondist/cli/index.jsdist/server/index.jsdist/server/store.jsdist/server/preview.jsskill/dreative/SKILL.md.codex/skills/dreativeAGENTS.md.dreative

Network endpoints2

localhost:${port}cdn.tailwindcss.com

dreative@0.5.4

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code