registry / @whalent/agent / 0.3.359

@whalent/agent@0.3.359

Stable wrapper for Whalent Agent core runtime

AI Security Review

scanned 3d ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. When the user starts the Whalent daemon, it can fetch remote agent configuration and synchronize managed skills into the configured Codex home. The distributed runtime is obfuscated, limiting verification of the scope of those operations.

Static reason

One or more suspicious static signals were detected.

Trigger

User runs whalent daemon with a token.

Impact

Can modify the user-selected Codex extension surface and handle local credentials during normal runtime.

Mechanism

Remote-configured agent runtime that manages Codex skills and credential copies.

Rationale

Source establishes runtime control over a Codex-related extension surface and credential migration, while obfuscation prevents full trust assessment. No install hook or concrete malicious payload was confirmed, so warning is proportionate.

Evidence

package.jsonREADME.mddist/index.cjsdist/core.cjs

Network endpoints1

memory.whalent.com

Decision evidence

public snapshot

AI called this Suspicious at 86.0% confidence as Dangerous Capability with low false-positive risk.

@whalent/agent@0.3.359

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code