registry / soloyolo / 0.0.2

soloyolo@0.0.2

Disciplined project copilot for vibe-coders — Claude Code keeps your git, memory, and decisions in order automatically.

AI Security Review

scanned 10h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

No blocking static signals were detected.

Trigger

User runs `soloyolo install`.

Impact

Subsequent Claude Code sessions execute soloyolo commands against the active project.

Mechanism

Writes package-owned Claude Code command hooks.

Rationale

This is not concrete malicious behavior, but it is an explicit user-command AI-agent configuration mutation and should be warned under policy.

Evidence

package.jsondist/commands/install.jsdist/core/settings.jsdist/commands/guard.jsdist/commands/session-start.jsdist/commands/session-end.js~/.claude/settings.json

Decision evidence

public snapshot

AI called this Suspicious at 94.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

Explicit `soloyolo install` writes Claude Code hooks and statusLine.

soloyolo@0.0.2

AI Security Review

Decision evidence

Source & flagged code

Findings