registry / soloyolo / 0.0.4

soloyolo@0.0.4

Disciplined project copilot for vibe-coders — Claude Code keeps your git, memory, and decisions in order automatically.

AI Security Review

scanned 10h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User runs `soloyolo install`, `dashboard-connect`, or `ship-execute`.

Impact

The package can influence Claude Code tool handling and transmit status metadata to a user-configured dashboard.

Mechanism

Claude hook registration and optional configured status upload.

Rationale

The package is not malicious by static inspection, but it has an explicit-user-command global AI-agent control-surface mutation. Policy classifies that retained capability as warn rather than block.

Evidence

package.jsondist/cli.jsdist/core/settings.jsdist/commands/install.jsdist/core/dashboard.jsdist/commands/dashboard-connect.jsdist/commands/ship-execute.jsdist/core/ship.js~/.claude/settings.json~/.soloyolo/dashboard.json.soloyolo/config.json

Decision evidence

public snapshot

soloyolo@0.0.4

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code