registry / @task-handoff/control-plane / 0.0.3

@task-handoff/control-plane@0.0.3

Prebuilt TaskHandoff control plane runtime.

AI Security Review

scanned 8h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Trigger

An authenticated operator sends a config-sync request, or explicitly fetches and runs `/install-node-agent.sh` as root.

Impact

An authorized control-plane user can alter AI-agent configuration or establish a persistent node-agent service on the chosen host.

Mechanism

User-invoked remote agent-config synchronisation and node-agent service setup.

Rationale

This is not concrete malware because flagged actions require explicit runtime/operator interaction and no lifecycle hook executes them. Its capability to transfer agent configuration and create a persistent service warrants a warning for downstream review.

Evidence

package.jsonbin/task-handoff-control-planedist/cli.js${CODEX_HOME}/config.toml${CODEX_HOME}/auth.json${CODEX_HOME}/AGENTS.md${CLAUDE_HOME}/settings.json${HOME}/.claude.json/etc/systemd/system/task-handoff-node-agent.service

Decision evidence

public snapshot

@task-handoff/control-plane@0.0.3

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code