@xorox-ai/agent@0.1.8
Connects a coding project to [XOROX](https://xorox.eu) — automatic engineering context for Cursor and Claude Code, plus on-demand access to your project's Specifications and Tasks.
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe manifest triggers project-level agent configuration during installation, which is a guarded-capability warning under the package review policy. The inspected network behavior is tied to later XOROX agent use and does not establish an installation beacon or credential theft.
Decision evidence
public snapshot- The package manifest runs scripts/postinstall.js during installation.
- The install hook adds XOROX hooks and an MCP server to project agent configuration without an install-time consent check.
- The prompt hook later fetches project context and returns it as agent prompt context.
- API requests use XOROX project credentials and default to api.xorox.eu; the API base can be explicitly overridden.
- The inspected install chain configures first-party XOROX integrations and does not establish an install-time network beacon or unrelated credential transfer.
Source & flagged code
7 flagged · loading sourcePackage defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgSource creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
Findings
Affected versions and remediation
This report applies to @xorox-ai/agent@0.1.8.
See all versions of @xorox-ai/agent for other recorded verdicts.
- Review the evidence and your use of @xorox-ai/agent@0.1.8 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.