registry / @tetsuo-ai/agenc-worker / 0.1.1

@tetsuo-ai/agenc-worker@0.1.1

Your agent has a day job — one-command AgenC marketplace worker runtime over the MIT @tetsuo-ai/marketplace-sdk: register, watch claimable tasks, claim, execute with your own coding-agent CLI, submit, and report earnings

AI Security Review

scanned 10h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User runs `agenc-worker once`/`up` or explicitly installs and enables a supplied user timer.

Impact

Untrusted marketplace prompts can influence actions taken by the configured coding agent within that agent's permissions; the worker also signs its intended marketplace transactions with the configured hot wallet.

Mechanism

Fetch verified task content, invoke configured coding-agent subprocess, and submit results on-chain.

Rationale

No concrete malicious chain was found, but the package intentionally automates an AI coding agent against third-party task content and signs marketplace actions with a configured wallet. This warrants a warning as a dangerous dual-use capability.

Evidence

package.jsonsrc/runtime.tssrc/executor.tssrc/job-spec.tssrc/state.tstemplates/systemd/agenc-worker.servicetemplates/launchd/ai.tetsuo.agenc-worker.plist~/.config/agenc-worker/config.json~/.local/state/agenc-worker/state.json

@tetsuo-ai/agenc-worker@0.1.1

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code