registry / @letta-ai/letta-agent-sdk / 0.2.6

@letta-ai/letta-agent-sdk@0.2.6

SDK for programmatic control of Letta agents

AI Security Review

scanned 17h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

No blocking static signals were detected.

Trigger

Caller invokes collectTranscripts, initDreamAgent, or dream with local/cloud/remote client options.

Impact

Selected local transcripts may be provided to the configured agent backend; selected MemFS repositories are modified under a declared policy.

Mechanism

User-directed transcript processing, agent execution, and guarded Git-hook setup.

Rationale

The package is not malicious by source inspection, but its explicit Dream API combines local AI-transcript access with agent-driven processing and repository mutation. Warn for dangerous dual-use capability rather than block.

Evidence

package.jsondist/index.jsREADME.md~/.claude/projects~/.codex/sessions~/.letta/agents/<agentId><memoryDir>/.git/dream-hooks

Network endpoints2

api.letta.comws://127.0.0.1:0

Decision evidence

public snapshot

@letta-ai/letta-agent-sdk@0.2.6

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code