registry / @tea-agent/loop-agent / 0.13.0

@tea-agent/loop-agent@0.13.0

`loop-agent` 是面向 AI coding agent 的仓库级任务运行时和治理工具。它把一次研发任务组织成可生成、可校验、可执行、可恢复、可交接的 Agent DAG，并用 `.harness/`、`docs/` 和 shell verification 记录执行事实、长期治理资料和完成依据。

AI Security Review

scanned 1d ago · by lpm-firewall-ai

No confirmed malicious attack surface is established. The package is an explicit CLI automation/agent orchestrator with user-invoked shell, Pi, init, and local observer capabilities.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Trigger

Explicit loop-agent/agent-worker command, DAG execution, or init command.

Impact

Commands can modify the selected project or execute configured DAG commands, but no install-time execution, covert exfiltration, or unconsented foreign agent-control mutation was found.

Mechanism

User-directed project automation with guarded shell execution and optional Pi-provider invocation.

Rationale

Source inspection confirms powerful but package-aligned, explicitly invoked automation behavior. No concrete malicious chain, install-time control-surface mutation, remote payload execution, or credential exfiltration was found.

Evidence

package.jsonbin/loop-agent.jsbin/agent-worker.jsdist/executors/shell-executor.jsdist/executors/shell-verification.jsdist/executors/pi-executor.jsdist/commands/init.jsdist/worker/observe/server.jsREADME.mdharness.jsonAGENTS.md.gitignore.agents/skills/

@tea-agent/loop-agent@0.13.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code