@cloop/runner@0.3.11
Make your machine and your agents Cloop runners: device login, the runner daemon, the Cloop MCP server, and Claude Code hooks.
AI Security Review
scanned 13d ago · by lpm-firewall-aiThe connected runner sends metadata from other recent Claude sessions to the package’s service by default, with an opt-out. Because the user must connect the runner and the inspected data is limited to metadata, this supports a warning about conditional privacy exposure rather than a publish block.
Decision evidence
public snapshot- The manifest exposes a CLI and has no install lifecycle hook.
- The runner scans recent Claude session files outside the active thread and extracts their working directories and titles.
- On connect, sharing is enabled unless the user selects the hide option; the runner includes the collected metadata in its presence payload.
- The presence socket sends that payload to the configured mesh endpoint, which defaults to the Cloop service.
- The websocket dependency code at the flagged location sets an ordinary Origin header.
- The metadata is sent only after the user connects the runner, and the destination is the package’s Cloop service.
- The inspected code extracts session metadata, not transcript contents, and provides a hide-other-threads option.
Source & flagged code
5 flaggedThis package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/box-4G3Z6BGK.jsView on unpkgPackage source references child process execution.
dist/box-4G3Z6BGK.jsView on unpkg · L149The runner scans recent Claude session files outside the active thread and extracts their working directories and titles.
Findings
Affected versions and remediation
This report applies to @cloop/runner@0.3.11.
See all versions of @cloop/runner for other recorded verdicts.
- Review the evidence and your use of @cloop/runner@0.3.11 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.