registry / fastcoder / 0.9.0

fastcoder@0.9.0

Fastcoder — CLI tool to register, inspect and report on local development projects.

AI Security Review

scanned 9h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

No blocking static signals were detected.

Trigger

User runs `fastcoder do`, `fastcoder flow`, `fastcoder init`, `cron:install`, or `webui:install`.

Impact

A malicious or untrusted task prompt can receive unattended Claude Code filesystem/shell authority within the selected project; credential use is confined to Claude usage retrieval.

Mechanism

Explicit local agent orchestration, project skill installation, and optional user-level persistence.

Rationale

Not malicious by the inspected source: sensitive behavior is user-command gated and package-aligned, with no install-time attack chain. Warn because the package deliberately enables unattended permission-bypassed AI-agent execution and writes agent control-surface files on explicit setup.

Evidence

package.jsonbin/fastcoder.jsdist/actions/run-claude-task.jsdist/cli/init.jsdist/cli/cron.jsdist/cli/webui.jsdist/infrastructure/ailimits-client.jsdist/infrastructure/windows-credentials.js.claude/skills/sonarqube-todo-tasks/SKILL.md.claude/commands/fastcoder-*.md.claude/skills/fastcoder/*/SKILL.md<project>/.docs/tasks/*

fastcoder@0.9.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code