registry / dsh-grok-tui / 0.3.3

dsh-grok-tui@0.3.3

把 [grok-build](https://github.com/xai-org/grok-build) 的 TUI 作为 [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness) (dsh) 的前端：界面是 grok 的，内核（提示词、工具、模型路由、会话持久化）由 dsh 提供。

AI Security Review

scanned 2d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installation silently modifies Herdr’s user-level agent-sidebar configuration. The mutation is best-effort but is triggered automatically by npm postinstall.

Static reason

One or more suspicious static signals were detected.

Trigger

npm installation with lifecycle scripts enabled

Impact

Unconsented mutation of a foreign AI-agent control-surface configuration.

Mechanism

postinstall executes a Python writer for Herdr config

Policy narrative

On installation, npm runs scripts/postinstall.sh, which invokes install-herdr-config.py. That script creates or merges ~/.config/herdr/config.toml to add dsh-grok-tui sidebar rows. Although the change is metric-display oriented and no exfiltration was found, it is an unconsented lifecycle-time write to a separate agent application’s configuration.

Rationale

This is concrete install-time mutation of a foreign AI-agent configuration, meeting the firewall block boundary despite its limited intended UI effect.

Evidence

package.jsonscripts/postinstall.shscripts/install-herdr-config.py~/.config/herdr/config.toml

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 94.0% confidence with low false-positive risk.

dsh-grok-tui@0.3.3

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code