registry / mancode / 0.3.12

mancode@0.3.12

AI coding agent workflow harness. Five modes from practice to playoffs: stop over-engineering, reuse project context, and add multi-agent code review.

AI Security Review

scanned 9h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. No automatic install-time attack surface is established. Explicit adapter installation can configure project-local AI-agent hooks and instruction files.

Static reason

No blocking static signals were detected.

Trigger

User runs `mancode init` or `mancode install <platform>` in a project.

Impact

Installed agent sessions may load mancode guidance and invoke its local hooks within that project.

Mechanism

Writes managed project-local agent configuration, skills, and Claude hook commands.

Rationale

This is not concrete malware: all agent-control mutations are behind explicit user CLI commands and are project-local. It remains a warning because it deliberately configures AI-agent lifecycle hooks and instruction surfaces.

Evidence

package.jsondist/cli.js.mancode/config.json.mancode/hooks/session-start.mjs.mancode/hooks/user-prompt-submit.mjs.claude/settings.json.claude/skills/.claude/agents/AGENTS.md.agents/skills/

Decision evidence

public snapshot

AI called this Suspicious at 93.0% confidence as Dangerous Capability with false-positive risk.

low

Evidence for warning

`dist/cli.js` explicitly installs Claude hooks into `.claude/settings.json`.
`dist/cli.js` writes generated hook files under `.mancode/hooks/`.
`dist/cli.js` writes managed instructions to `AGENTS.md` and `.agents/skills/` for Codex.
These control-surface changes are reached through explicit `init`/`install` CLI commands.

Evidence against

`package.json` has no preinstall, install, or postinstall lifecycle hook.
No network client or endpoint is present in the inspected runtime bundle.
Generated hooks read project-local JSON and stdin, then print guidance; no exfiltration was found.
Child-process use is bounded to local `git` commands and package-local hook execution.
No eval, native payload loading, credential harvesting, or destructive broad filesystem behavior was found.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStrings

Manifest

CopyleftLicense

scanned 7 file(s), 1.81 MB of source

Source & flagged code

1 flagged

dist/cli.jsView file

238prepare("validate"), L239: // The staging directory is private to this operation and has no task L240: // locator/fence visibility. A crash here is compensable by deleting ... L1050: try { L1051: parsed = JSON.parse(content); L1052: } catch { ... L1736: } catch (error) { L1737: if (process.platform !== "win32" || !isRetriableWindowsRenameError(error) || attempt === maxAttempts) { L1738: throw error; ... L1916: // src/runtime/project-runtime.ts L1917: import { execFile as execFileCallback } from "child_process"; L1918: import { createHash } from "crypto";

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/cli.jsView on unpkg · L238

Source & flagged code

1 flagged · loading source

dist/cli.jsView file

238prepare("validate"), L239: // The staging directory is private to this operation and has no task L240: // locator/fence visibility. A crash here is compensable by deleting ... L1050: try { L1051: parsed = JSON.parse(content); L1052: } catch { ... L1736: } catch (error) { L1737: if (process.platform !== "win32" || !isRetriableWindowsRenameError(error) || attempt === maxAttempts) { L1738: throw error; ... L1916: // src/runtime/project-runtime.ts L1917: import { execFile as execFileCallback } from "child_process"; L1918: import { createHash } from "crypto";

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/cli.jsView on unpkg · L238

Findings

1 Medium6 Low

MediumEnvironment Vars

LowNon Install Lifecycle Scripts

LowScripts Present

LowWeak Cryptodist/cli.js

LowFilesystem

LowHigh Entropy Strings

LowCopyleft License

LPM CLI

Entrypointsexports mapbin → mancode

Runtimenode >=20

Artifact5.37 MB · 21 files1 signature(s)

Install lifecycleprepublishOnly

Behavioral surface

ChildProcessCryptoEnvironmentVarsFilesystemShellHighEntropyStringsCopyleftLicense

Source & flagged code

1 flagged

dist/cli.jsView file

238prepare("validate"), L239: // The staging directory is private to this operation and has no task L240: // locator/fence visibility. A crash here is compensable by deleting ... L1050: try { L1051: parsed = JSON.parse(content); L1052: } catch { ... L1736: } catch (error) { L1737: if (process.platform !== "win32" || !isRetriableWindowsRenameError(error) || attempt === maxAttempts) { L1738: throw error; ... L1916: // src/runtime/project-runtime.ts L1917: import { execFile as execFileCallback } from "child_process"; L1918: import { createHash } from "crypto";

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/cli.jsView on unpkg · L238