registry / sourcepin / 0.2.0

sourcepin@0.2.0

Pin feedback to UI and trace it to source for coding agents.

AI Security Review

scanned 21h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

No blocking static signals were detected.

Trigger

User runs `sourcepin init` or uses SourcePin CLI/MCP/UI features.

Impact

Can add a SourcePin skill under the current project's `.agents` directory; no exfiltration or remote execution confirmed.

Mechanism

Explicit agent-skill setup and local feedback persistence.

Rationale

The package is not malicious by source inspection, but its explicit agent-control-surface write warrants a warning under the firewall policy.

Evidence

package.jsondist/cli.jsdist/cli-core-s5LG-U04.jsdist/store-iqimEseB.jsdist/mcp.jsdist/next.js.agents/skills/sourcepin-feedback/SKILL.md.sourcepin/pins/*.json

Decision evidence

public snapshot

AI called this Suspicious at 92.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

sourcepin@0.2.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code