registry / patchlane / 0.4.0

patchlane@0.4.0

CLI tool for maintaining forked repositories with custom patches

AI Security Review

scanned 2h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

No blocking static signals were detected.

Trigger

User runs `patchlane agents` or `npx patchlane agents`.

Impact

Remote content can influence an AI-agent skill directory selected by the user; the source base URL is environment-overridable.

Mechanism

Remote agent-skill download and managed local installation.

Rationale

Source inspection found no malicious install-time behavior, credential theft, or hidden exfiltration. The package nevertheless installs remotely fetched AI-agent skills on an explicit command, so it warrants a warning under the firewall policy.

Evidence

package.jsondist/cli.jsdist/agents-install.jsdist/subprocess.jsdist/init.jsdist/integration-sync.jsdist/promote-sync.js.agents/skills.agents/skills/.patchlane-install.json

Network endpoints1

raw.githubusercontent.com/adampoit/patchlane/v0.4.0/skills

patchlane@0.4.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code