registry / @agent-qofeno/agentx-cli / 1.20.92

@agent-qofeno/agentx-cli@1.20.92

<p align="center"> <h1 align="center">@agent-qofeno/agentx-cli</h1> <p align="center"><strong>The autonomous AI agent that builds production-ready websites from your terminal.</strong></p> </p>

AI Security Review

scanned 7d ago · by lpm-firewall-ai

No install-time attack surface was found. On explicit `agentx` invocation, the JavaScript launcher executes an opaque bundled Windows PE binary whose contents cannot be source-reviewed.

Static reason

No blocking static signals were detected.

Trigger

User runs the agentx CLI.

Impact

Unresolved runtime behavior is confined to explicit CLI execution; no concrete malicious behavior was established.

Mechanism

launcher dispatches to packaged native executable

Rationale

No concrete malicious behavior was found in readable sources, but the package’s effective CLI payload is an opaque native binary. Warn rather than block because execution is explicit user invocation and there is no install-time mutation or confirmed exfiltration.

Evidence

package.jsonbin/agentx.cjsbin/agentxbin/agentx.exeskills/ui-ux-pro-max/scripts/tests/test_data_contracts.py

Decision evidence

public snapshot

AI called this Suspicious at 86.0% confidence as Unknown with medium false-positive risk.

Evidence for warning

The user-invoked CLI launcher resolves and executes a packaged native binary.
bin/agentx and bin/agentx.exe are large opaque PE executables, preventing source-level validation of their behavior.

@agent-qofeno/agentx-cli@1.20.92

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code