registry / gmsniff / 1.0.24

gmsniff@1.0.24

Observability GUI for gm — explores every gm-log subsystem in real time

AI Security Review

scanned 9h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User runs edit/dispatch commands or uses the local GUI control endpoints.

Impact

Can affect a selected GM agent workflow if deliberately invoked.

Mechanism

User-invoked .gm configuration edits and lifecycle-spool writes

Rationale

No concrete malicious chain was found. The explicit agent-workflow mutation capability warrants a warning under the stated policy.

Evidence

package.jsonsrc/cli.jssrc/server.jssrc/registry.js

Network endpoints1

127.0.0.1

Decision evidence

public snapshot

AI called this Suspicious at 96.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

src/cli.js exposes explicit --prd-edit, --mutable-edit, and --dispatch writes to a chosen project’s .gm files.

gmsniff@1.0.24

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code