registry / rhachet-roles-ghlitch / 0.2.5

rhachet-roles-ghlitch@0.2.5

observability, deployment, diagnostics, budgets, alerts, and security roles and skills, via rhachet

AI Security Review

scanned 4h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. A guarded prepare hook configures Husky and initializes this package's Rhachet keys, hooks, and roles in a Git checkout. Infrastructure commands run only through explicit Rhachet skill invocation.

Static reason

No blocking static signals were detected.

Trigger

npm prepare in a Git checkout with CI unset; or explicit rhx deployment/operator commands.

Impact

May modify local Rhachet/Husky configuration and, when explicitly invoked, use local AWS credentials for deployment operations.

Mechanism

guarded agent-extension and VCS-hook initialization; user-invoked AWS deployment tooling

Rationale

No concrete malicious chain or exfiltration was found. The automatic, guarded first-party agent/VCS extension setup warrants a warning under the lifecycle policy.

Evidence

package.jsondist/domain.roles/deployer/getDeployerRole.jsdist/domain.roles/deployer/skills/provision.terraform.shdist/domain.roles/deployer/skills/uses._.operations.shdist/index.js.husky/*~/.rhachet/storage/repo=ghlitch/role=deployer/.meter/*.jsonc<git-root>/.meter/*.jsonc

Decision evidence

public snapshot

rhachet-roles-ghlitch@0.2.5

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code