registry / agents-office-tower / 0.1.2

agents-office-tower@0.1.2

Live pixel-office view for agent work across Codex, Claude, Cursor, Hermes, OpenClaw, cloud tasks, and shared rooms.

AI Security Review

scanned 19h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. No install-time attack surface is established. Explicit user commands can install a first-party Hermes integration or write a user service definition for the package's local web server.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User runs `aot agents link hermes` or `aot service install`.

Impact

May modify the selected Hermes home or user service configuration; no automatic activation is performed by the service command.

Mechanism

User-invoked agent-extension setup and local-service configuration.

Rationale

Source shows guarded platform/agent integration capabilities rather than malicious behavior. Per policy, explicit first-party agent configuration mutation warrants a warning.

Evidence

package.jsondist/index.jsdist/lifecycle.jsdist/status.jsdist/web-query.jsdist/demo-preview.js~/.hermes~/Library/LaunchAgents/com.agents-tower.aot.plist~/.config/systemd/user/agents-office-tower.servicetemporary directory agents-office-preview-*

Network endpoints1

127.0.0.1:4181

agents-office-tower@0.1.2

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code