registry / micro-generate / 1.3.12

micro-generate@1.3.12

Microservices project with Node.js, Express, Mongoose, Redis, and GraphQL

AI Security Review

scanned 3h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

No blocking static signals were detected.

Trigger

User runs `micro-generate init`.

Impact

Adds agent-executable instructions to the generated project's `.agent` control surface.

Mechanism

Explicit CLI scaffolding writes an agent skill and project files.

Rationale

The package is a normal scaffold generator, but its explicit init path writes a project agent skill. Per policy, this is a warning-level AI-agent capability risk rather than a publish-blocking malicious action.

Evidence

package.jsondist/cli/index.jsdist/cli/generators/init-generator.jsdist/cli/templates/project/skill.template.js

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

`init` writes `.agent/skills/micro-generate/SKILL.md`.
The generated skill directs agents to run `npx micro-generate`.

micro-generate@1.3.12

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code