registry / storymine / 0.1.1

storymine@0.1.1

A local-first CLI that finds useful blog ideas in Claude and Codex coding chats.

AI Security Review

scanned 16h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. No install-time attack surface is established. An explicit CLI command can invoke an external skill installer, and explicit scans read local AI transcripts before sending redacted excerpts to the chosen model command.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User runs `storymine skill install` or a scan/audit command

Impact

The skill command may alter an agent skill installation through its external installer; scans expose redacted excerpts to the selected provider.

Mechanism

Explicit agent-skill setup and local transcript analysis via user-selected model command

Rationale

No concrete malicious chain was found, but the explicit agent-extension installer is a policy-defined lifecycle risk requiring a warning. Its local-data and model-command behavior is disclosed and user-invoked.

Evidence

package.jsondist/cli.jsdist/chunk-BD5LWJEL.jsREADME.mdPRIVACY.md~/.claude/projects~/.codex/sessionsStorymine config/cache/log directories

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Dangerous Capability with false-positive risk.

storymine@0.1.1

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code