registry / idea-gauntlet / 0.3.0

idea-gauntlet@0.3.0

Stress-test product ideas with adversarial agents, synthetic users, and court-style critique.

AI Security Review

scanned 2h ago · by lpm-firewall-ai

LPM blocks this version under the AI-agent control-surface policy. Installing the package triggers automatic integration setup. It detects installed AI coding-agent configuration roots and writes package-generated instruction/configuration files there without an explicit setup command.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm postinstall

Impact

Changes Claude, Codex, Cursor, and MCP control surfaces during dependency installation.

Mechanism

automatic foreign AI-agent configuration and instruction-file mutation

Policy narrative

The npm postinstall hook runs the package installer automatically. That installer discovers standard Claude, Codex, and Cursor directories, generates agent instructions including Codex AGENTS.md content, and writes integration/MCP configuration into detected external agent-control locations. Although it is conflict-aware and reversible, the mutation is unconsented and occurs at install time rather than through an explicit user setup command.

Rationale

Source confirms an install-time mutation chain targeting foreign AI-agent control surfaces. This meets the blocking policy regardless of the benign product purpose or guarded network code.

Evidence

package.jsondist/postinstall.jsdist/chunk-AYVXGNOK.jsdist/chunk-MGW5ADB2.js~/.claude~/.codex~/.cursor~/.config/idea-gauntlet/mcp-config.json~/.config/idea-gauntlet/install-manifest.json

idea-gauntlet@0.3.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code