registry / litopencode / 0.1.50

litopencode@0.1.50

LitOpenCode OpenCode plugin bootstrap package.

AI Security Review

scanned 16h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

No blocking static signals were detected.

Trigger

User runs `litopencode install` without `--dry-run`.

Impact

Changes the target OpenCode environment and may set selected agent permission behavior.

Mechanism

CLI-managed OpenCode plugin/configuration and native-skill installation.

Rationale

This is an explicit user-command agent configuration installer, not malicious npm install-time behavior. Warn because it can alter an AI-agent environment and expose a YOLO permission mode.

Evidence

package.jsonbin/litopencode.cjsdist/cli.jsdist/cli/args.jsdist/cli/install.jsdist/cli/native-skill-install.jsdist/public-source-fetch.jsdist/cli/install-config.jsdist/cli/plugin-mutation.jsdist/cli/native-skill-integrity.jsdist/public-source-fetch-http.jsdist/public-source-fetch-ssrf.js

litopencode@0.1.50

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code