@agimon-ai/po-container-runtime-linux-x64@0.0.1-alpha.4
Read-only Po server payload for Linux x64 sandbox containers, mounted at /opt/po and run with Node 24.
AI Security Review
scanned 14d ago · by lpm-firewall-aiThe manifest and inspected runtime excerpts support normal container runtime, session extension, and ChatGPT authentication behavior. The scanner's incomplete coverage is not itself evidence of malicious behavior, and no concrete attack surface was found in the reviewed source.
Decision evidence
public snapshot- package.json publishes runtime artifacts, exports JSON metadata, and has only a build script, with no install hook.
- The flagged server code registers resources and tools supplied by the active session with the host agent.
- The token request targets auth.openai.com and uses scopes identified for ChatGPT connector sign-in.
- The tool service code normalizes a service bound to all interfaces to loopback.
- The Po session MCP authorization code defines bounded access-token and authorization-code lifetimes.
- The runtime includes compiler dependencies and uses a configurable local Po home directory.
Source & flagged code
9 flaggedThe scanner resource watchdog stopped semantic analysis before full coverage; route this package to AI without publishing a static verdict.
package.json publishes runtime artifacts, exports JSON metadata, and has only a build script, with no install hook.
package.jsonView on unpkg · L25Findings
Affected versions and remediation
This report applies to @agimon-ai/po-container-runtime-linux-x64@0.0.1-alpha.4.
See all versions of @agimon-ai/po-container-runtime-linux-x64 for other recorded verdicts.
- Review the evidence and your use of @agimon-ai/po-container-runtime-linux-x64@0.0.1-alpha.4 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.