@agimon-ai/po-container-runtime-linux-arm64@0.0.1-alpha.25
Read-only Po server payload for Linux arm64 sandbox containers, mounted at /opt/po and run with Node 24.
AI Security Review
scanned 11d ago · by lpm-firewall-aiThe manifest contains a build script but no install hook, and the container manifest selects the packaged server as its entry point. Inspected flagged source showed runtime registration, telemetry helpers, and ordinary bundled support code, with no concrete attack behavior identified.
Decision evidence
public snapshot- package.json defines only a build script; it has no install lifecycle hook.
- container-runtime.json points to the packaged server as the container entry.
- The server registers session-provided resources and tools, passing tool calls through abort-aware callbacks.
- The inspected runtime bundles contain telemetry helpers and standard runtime or build-tool code; no harmful behavior was identified.
Source & flagged code
9 flaggedThe scanner resource watchdog stopped semantic analysis before full coverage; route this package to AI without publishing a static verdict.
package.json defines only a build script; it has no install lifecycle hook.
package.jsonView on unpkg · L36Findings
Affected versions and remediation
This report applies to @agimon-ai/po-container-runtime-linux-arm64@0.0.1-alpha.25.
See all versions of @agimon-ai/po-container-runtime-linux-arm64 for other recorded verdicts.
- Review the evidence and your use of @agimon-ai/po-container-runtime-linux-arm64@0.0.1-alpha.25 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.