registry / envx-cli / 1.6.0

envx-cli@1.6.0

Environment file encryption and management tool

AI Security Review

scanned 18h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User runs envx skill add, or confirms skill installation during envx init.

Impact

Installed coding agents may follow the package-supplied EnvX workflow within that project.

Mechanism

Project-local AI-agent skill installation

Rationale

This is a first-party, confirmation-gated AI-agent extension capability rather than malicious behavior. Per policy, its project agent-control write surface warrants a warning, while source inspection found no exfiltration, remote payload execution, or unconsented lifecycle mutation.

Evidence

package.jsondist/index.jsdist/commands/skill.jsskills/envx/SKILL.mddist/utils/update-check.jsdist/utils/exec.jsdist/utils/file.jsdist/commands/run.js.agents/skills/envx/SKILL.md.claude/skills/envx/SKILL.md.cursor/skills/envx/SKILL.md.codex/skills/envx/SKILL.md~/.envx/update.json

Network endpoints1

envx-cli@1.6.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code