registry / lgmind / 0.5.0

lgmind@0.5.0

Install, verify, rollback, and uninstall LegionMind assets for coding agents.

AI Security Review

scanned 2h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User runs `lgmind`/`setup-opencode` install or invokes the OpenClaw install script.

Impact

Adds package-owned skills to selected OpenCode/OpenClaw locations; uninstall/rollback can modify only managed targets.

Mechanism

User-invoked agent asset installation and configuration update.

Rationale

Source inspection confirms an explicit agent-integration installer rather than malware. Per the firewall policy, its user-invoked agent configuration mutation remains a warn-level capability risk, not a publish-block event.

Evidence

package.jsonscripts/lgmind.jsscripts/setup-opencode.jsscripts/setup-openclaw.jsscripts/lib/setup-core.jsskills/git-worktree-pr/scripts/refresh-main-workspace.mjsbin/lgmind.jsbin/setup-opencode.js~/.config/opencode/agents~/.config/opencode/plugins~/.agents/skills~/.openclaw/openclaw.json~/.openclaw/skills

lgmind@0.5.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code