registry / show-sidekick / 0.3.0

show-sidekick@0.3.0

Show-first AI pre-production for video — build the rough cut, finish in your NLE.

AI Security Review

scanned 5h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

No blocking static signals were detected.

Trigger

User runs `showkick init` or `showkick update`; individual tools run only when selected.

Impact

Can alter the project’s agent-extension context; no unconsented install-time control-surface mutation or malicious exfiltration is established.

Mechanism

project-local agent skill mirroring and configured provider API calls

Rationale

The package is not concretely malicious, but it has a real explicit-user-command AI-agent extension lifecycle surface. Per policy this warrants a warning rather than a block.

Evidence

package.jsondist/cli/index.jsdist/cli/commands/init.jsdist/cli/commands/update.jsdist/version/bundled.jsdist/tools/playwright-recording.jsdist/tools/openai-image.jsdist/tools/brave-search.js.agents/skills.claude/skills.show-sidekick

Network endpoints2

api.openai.com/v1/images/generations/res/v1/web/search

show-sidekick@0.3.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code