registry / @everworker/oneringai / 0.10.1

@everworker/oneringai@0.10.1

Unified AI agent library with multi-vendor support for text generation, image generation, and agentic workflows

AI Security Review

scanned 6h ago · by lpm-firewall-ai

No confirmed malicious attack surface. Runtime network and tool actions require host-created connectors or explicit agent-tool registration; no install-time execution or secret exfiltration was found.

Static reason

One or more suspicious static signals were detected.

Trigger

Host application configures and invokes providers, connectors, or exported agent tools.

Impact

Configured tools can access their caller-authorized resources; no unsolicited package behavior was identified.

Mechanism

User-configured AI provider and agent-tool framework.

Rationale

The scanner's secret signal is encryption/token-handling code, not a hard-coded credential. Lifecycle hooks only build/publish workflows, and inspected runtime capabilities are package-aligned, opt-in framework features.

Evidence

package.jsondist/index.jsdist/capabilities/images/index.js

Network endpoints4

api.openai.com/v1api.anthropic.comgenerativelanguage.googleapis.comus-central1-aiplatform.googleapis.com

Decision evidence

public snapshot

@everworker/oneringai@0.10.1

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code