registry / samemind / 0.1.2

samemind@0.1.2

Git-native, zero-infra markdown memory for AI coding agents — one bundle, every engine, no database.

AI Security Review

scanned 19h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

No blocking static signals were detected.

Trigger

User runs samemind install --agent <id> or enables semantic indexing/search.

Impact

Agent behavior can be influenced through installed instruction blocks; configured embedding services receive indexed text.

Mechanism

Explicit agent-config injection and optional embedding POST.

Rationale

Source shows an explicit, user-invoked agent configuration mutation capability but no lifecycle hook or concrete malicious behavior. Policy classifies this as warn-level dangerous capability rather than a block.

Evidence

package.jsonbin/samemind.mjstools/install.mjstools/lib/recall.mjstools/lib/mcp.mjsAGENTS.mdCLAUDE.mdGEMINI.md.cursor/rules/samemind.md.github/copilot-instructions.mdinbox/<agent>.md

Network endpoints1

127.0.0.1:8000/v1/embeddings

samemind@0.1.2

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code