registry / incremnt / 0.8.10

incremnt@0.8.10

Command-line tool for querying your incremnt strength training data

AI Security Review

scanned 3h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

User runs `incremnt mcp install`.

Impact

Registered assistants can invoke the package's training-data tools under the user's configured credentials.

Mechanism

Explicit MCP configuration writes and authenticated API-backed tools.

Rationale

The scanner's lifecycle finding is a false positive: postinstall only writes a message. The explicit AI-agent registration remains a meaningful extension capability risk but is documented and user-invoked, not malicious behavior.

Evidence

package.jsonsrc/lib.jssrc/mcp.jssrc/remote.jsREADME.md~/.claude.json~/.codex/config.toml

Network endpoints1

incremnt-sync.onrender.com

Decision evidence

public snapshot

AI called this Suspicious at 93.0% confidence as Dangerous Capability with false-positive risk.

incremnt@0.8.10

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code