registry / @sym-bot/xmesh / 0.2.2

@sym-bot/xmesh@0.2.2

xMesh — decision and cognition generation for the agentic-native organization. Desktop server + web cockpit on the open @sym-bot substrate.

AI Security Review

scanned 18h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Trigger

An authenticated user invokes POST /api/workers or restores a prior worker roster.

Impact

A selected workspace can receive AGENTS.md/CLAUDE.md changes and agent-driven file/command activity; approved Codex work may use full access.

Mechanism

Workspace instruction-file projection and spawned Claude/Codex agent workers.

Rationale

The package intentionally provides authenticated, user-invoked agent-worker orchestration with mutable workspace instructions and potentially broad CLI execution. Its behavior warrants a warning, but the inspected source does not establish malicious or unconsented install-time behavior.

Evidence

package.jsonbin/xmesh.jsdist/server/index.jsdist/server/hosted-workers.jsdist/worker/commission-worker.jsAGENTS.mdCLAUDE.md~/.xmesh/workers.json

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence with false-positive risk.

@sym-bot/xmesh@0.2.2

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code