Loading npm security reports…
Stateless, task-oriented AI agent core
This is an AI-agent runtime exposing explicit shell, filesystem, LLM, and web-fetch capabilities to its host application. No automatic install/import-time execution, credential harvesting, or unsolicited exfiltration was confirmed. Network access is provider- or caller-configured and web fetch includes SSRF controls.
Package source references child process execution.
dist/core/session-store.jsView on unpkg · L95Package source references a known benign dynamic code generation pattern.
dist/core/auto-promote.jsView on unpkg · L32Source matches reverse-shell style process and socket wiring.
dist/core/auto-mode-prompt-assets.jsView on unpkg · L1A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/core/auto-mode-prompt-assets.jsView on unpkg · L1Package source references child process execution.
dist/core/session-store.jsView on unpkg · L95Package source references a known benign dynamic code generation pattern.
dist/core/auto-promote.jsView on unpkg · L32Source matches reverse-shell style process and socket wiring.
dist/core/auto-mode-prompt-assets.jsView on unpkg · L1A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/core/auto-mode-prompt-assets.jsView on unpkg · L1