registry / opensip-cli / 0.3.0

opensip-cli@0.3.0

OpenSIP CLI — codebase analysis from the command line (the CLI; `npm i -g opensip-cli`)

AI Security Review

scanned 20h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User runs `opensip init` in a project.

Impact

Changes local agent instruction/control files; no exfiltration or stealth persistence confirmed.

Mechanism

Explicit project scaffolding and managed AI-guidance writes.

Rationale

The package is not malicious by the blocking threshold, but its explicit init command modifies AI-agent control-surface files. Policy classifies this as a warn-level capability risk.

Evidence

package.jsondist/index.jsdist/commands/host-command-specs.jsdist/commands/init/agent-guidance.jsdist/commands/init/scaffold-writer.jsdist/bootstrap/capability-worker/guards.jsAGENTS.mdCLAUDE.md.github/copilot-instructions.md.cursorrules.cursor/rules/opensip.mdc.windsurfrules

opensip-cli@0.3.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code