registry / taito-cli / 1.5.0

taito-cli@1.5.0

CLI for initializing projects from customizable templates and managing customizable Agent Skills.

AI Security Review

scanned 2h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

No blocking static signals were detected.

Trigger

User runs `taito add` or `taito apply skill` and selects an agent/source.

Impact

Selected third-party skill instructions can become discoverable by configured AI coding agents.

Mechanism

User-invoked agent skill installation and symlink management.

Rationale

This package has a real, user-invoked capability to modify AI-agent skill control surfaces, warranting a warning under the firewall policy. It does not show concrete malicious behavior or unconsented install-time mutation.

Evidence

package.jsonscripts/run.shdist/taito.js.mapdist/taito-*.agents/skills.claude/skills.cursor/skills.codex/skills.windsurf/skills

Network endpoints1

codeload.github.com

Decision evidence

public snapshot

AI called this at 82.0% confidence with false-positive risk.

taito-cli@1.5.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code