registry / @kky42/pievo / 0.4.0

@kky42/pievo@0.4.0

Pievo LOOP harness for durable metric-driven agent optimization loops

AI Security Review

scanned 7d ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

No blocking static signals were detected.

Trigger

User runs Pievo loop or daemon commands with a workflow selecting these backends.

Impact

A user-provided or untrusted loop specification can cause local code execution through configured checks or delegated agents.

Mechanism

User-invoked agent orchestration and shell command execution.

Rationale

Source inspection confirms an explicit, high-privilege local agent/shell orchestration capability. It is user-invoked and package-aligned rather than a concrete malicious chain, so warn rather than block.

Evidence

package.jsonbin/pievo.jssrc/runtime/pi-flow-runner.jssrc/eval/core-check-runner.jssrc/daemon/client.jssrc/cli/main.jssrc/daemon/server.jssrc/store/paths.jssrc/export/export-loop.js

Network endpoints1

127.0.0.1

Decision evidence

public snapshot

@kky42/pievo@0.4.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code