registry / @ai-content-space/loopx / 0.3.8

@ai-content-space/loopx@0.3.8

Skill-first workflow suite for agentic coding assistants

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

No confirmed malicious attack surface; install-time behavior is package-aligned skill and hook installation for an agent workflow tool. It writes local agent skill/hook files but does not exfiltrate data or execute hidden payloads.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

npm postinstall or explicit loopx CLI commands

Impact

Adds/updates loopx-managed files in user agent and project workflow locations

Mechanism

local skill/hook installer and workflow CLI

Rationale

Static inspection shows the lifecycle hook performs the advertised installation of agent skills/hooks with ownership checks and opt-outs; the risky primitives are aligned with the package purpose. No hidden payload, credential collection, destructive behavior, or unconsented network exfiltration was found.

Evidence

package.jsonscripts/install-skills.mjssrc/cli.mjssrc/install-discovery.mjssrc/version-check.mjssrc/lancet-runtime.mjs~/.agents/skills/<skill>~/.agents/.skill-lock.json~/.codex/hooks/codex-workflow-hook.mjs~/.claude/hooks/loopx-workflow-hook.mjs~/.claude/settings.json~/.codex/AGENTS.md~/.claude/CLAUDE.md~/.loopx/template-hashes.json~/.loopx/lancet/session.json

@ai-content-space/loopx@0.3.8

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code