registry / elia-ai / 0.1.4

elia-ai@0.1.4

A fast, autonomous coding agent for the terminal, with pluggable LLM providers.

AI Security Review

scanned 3h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package automatically invokes a third-party skill synchronization command. Failures are hidden, making the install-time mutation non-transparent.

Static reason

One or more suspicious static signals were detected.

Trigger

npm installs elia-ai.

Impact

It can change a foreign AI-agent skill control surface without the installer's explicit approval.

Mechanism

Post-install invocation of Prisma skill synchronization.

Policy narrative

The package's post-install lifecycle hook runs Prisma skill synchronization whenever the package is installed. This is an automatic third-party AI-agent integration action rather than a user-invoked setup command, and the shell fallback conceals whether it failed. The package source does not establish a constrained, package-owned destination for that synchronization.

Rationale

The install-time hook creates an unconsented AI-agent control-surface mutation and hides errors. This is concrete install-hook abuse even though the rest of the application includes ordinary user-invoked agent capabilities.

Evidence

package.json

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 93.0% confidence with low false-positive risk.

Evidence for policy risk

The automatic post-install hook runs Prisma's skill synchronization command and deliberately suppresses any failure.

elia-ai@0.1.4

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code