registry / interference-agent / 0.3.1

interference-agent@0.3.1

The open-source coding agent that lives in your terminal.

AI Security Review

scanned 5h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. Launching the CLI automatically provisions bundled AI-agent skill files in its own ~/.interference directory. No install-time hook, foreign agent-control write, or concrete malicious payload was found.

Static reason

No blocking static signals were detected.

Trigger

User runs the interference CLI.

Impact

Persistent package-owned instruction files; runtime tools can act in the user workspace as directed by the selected model.

Mechanism

First-party agent skill bootstrap and interactive coding-agent tooling.

Rationale

The automatic first-party skill provisioning warrants a warning under the agent-extension lifecycle policy. Source inspection otherwise supports an intended interactive coding-agent implementation rather than malicious behavior.

Evidence

package.jsonsrc/cli.tssrc/skills.tssrc/paths.tssrc/catalog.tssrc/tools/bash.tssrc/context.ts~/.interference/skills/*/SKILL.md~/.interference/auth.json~/.interference/cache/models.json

Network endpoints6

models.dev/api.jsonregistry.npmjs.org/interference-agent/latestapi.openai.com/v1

interference-agent@0.3.1

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code