registry / @deriest/ai-engineering-company / 2.0.0

@deriest/ai-engineering-company@2.0.0

AI Engineering Company management layer

AI Security Review

scanned 9h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. This is a first-party OpenClaw orchestration plugin that activates on platform startup and can dispatch configured subagents. No unconsented install-time mutation or concrete exfiltration chain was found.

Static reason

No blocking static signals were detected.

Trigger

OpenClaw loads the enabled plugin; dispatch tools, CLI, or scoped gateway methods are invoked.

Impact

Can orchestrate OpenClaw subagents and write its own operational state; behavior is platform-aligned but privileged.

Mechanism

Startup agent-extension registration with local state persistence and optional configured Redis queueing.

Rationale

The source contains a genuine privileged agent-extension lifecycle surface, warranting a warning under policy. It lacks lifecycle hooks, secret collection, unconfigured external endpoints, remote payload execution, or destructive behavior required for a block.

Evidence

package.jsonopenclaw.plugin.jsondist/index.jsdist/dispatch-service.jsdist/gateway.jsdist/commands/dashboard.js.openclaw/metrics.json.openclaw/decisions.json.openclaw/pipeline-checkpoints.json.openclaw/audit/

Decision evidence

public snapshot

@deriest/ai-engineering-company@2.0.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code