registry / @qwixl/agent-backend / 0.5.1

@qwixl/agent-backend@0.5.1

Owner-controlled Atom agent backend: A2A transport, MLS E2E, signed data objects.

AI Security Review

scanned 6h ago · by lpm-firewall-ai

No confirmed malicious attack surface. User-started server exposes intentional agent, calendar, payment, and LLM features using owner-supplied configuration.

Static reason

No blocking static signals were detected.

Trigger

Explicit atom-agent execution or importing and calling startAgentServer.

Impact

Performs requested agent, Calendar, Stripe, and LLM operations; no unconsented install-time action found.

Mechanism

Configured local agent backend and provider API client.

Rationale

Source implements an explicitly run, owner-configured agent backend. Network and credential handling are feature-aligned, with no install-time execution or concrete malicious chain.

Evidence

package.jsondist/cli.jsdist/server.jsdist/identity.jsdist/config.jsdist/agUi/llmRunner.jsdist/googleCalendar.jsdist/payment/stripeClient.js

Network endpoints4

api.openai.com/v1api.stripe.com/v1www.googleapis.com/oauth2/v2/userinfoapidata.googleusercontent.com/caldav/v2/

@qwixl/agent-backend@0.5.1

AI Security Review

Decision evidence

Source & flagged code

Findings