registry / @everworker/oneringai / 0.10.2

@everworker/oneringai@0.10.2

Unified AI agent library with multi-vendor support for text generation, image generation, and agentic workflows

AI Security Review

scanned 4h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

One or more suspicious static signals were detected.

Trigger

An application configures and invokes agent tools, connectors, or persistent instruction storage.

Impact

A consuming application that grants untrusted agent input access to these tools could execute commands, access configured services, or alter package-owned agent state.

Mechanism

Runtime agent-tool execution, configured API requests, and local state persistence.

Rationale

Source inspection found dangerous dual-use agent capabilities but no concrete malicious chain, lifecycle abuse, covert exfiltration, or foreign AI-agent control-surface mutation. Warn so downstream users assess tool exposure and permission configuration.

Evidence

package.jsondist/index.jsdist/capabilities/images/index.js~/.oneringai/agents/<agentId>/custom_instructions.json<configured OAuth token directory>/<sha256>.token

Decision evidence

public snapshot

AI called this Suspicious at 88.0% confidence as Dangerous Capability with low false-positive risk.

@everworker/oneringai@0.10.2

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code