arcroom@0.0.2-beta
Shared team memory and run control for coding agents: Claude Code, Codex, Cursor, OpenCode
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe agent-configuration writes are triggered by the user’s explicit `arcroom init` command and configure ArcRoom’s project integration. Runtime requests send the saved key to the configured ArcRoom API, while the README discloses the collected data and an off switch; no malicious behavior was identified.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Trigger
The user explicitly runs `arcroom init`; configured hooks then run during agent sessions.
Impact
The disclosed service receives prompts and activity metadata for shared team memory; the README says file contents and tool output are excluded and provides an off switch.
Mechanism
Initialization writes project-scoped agent settings and hooks. Runtime requests use the saved API key with the configured API host.
AI rationale
The agent-configuration writes are triggered by the user’s explicit `arcroom init` command and configure ArcRoom’s project integration. Runtime requests send the saved key to the configured ArcRoom API, while the README discloses the collected data and an off switch; no malicious behavior was identified.
Evidence
~/.arcroom/config.json~/.arcroom/runtime/<project>/.claude/settings.local.json<project>/.mcp.json<project>/.codex/hooks.json<project>/.codex/config.toml<project>/.cursor/hooks.json<project>/.cursor/mcp.json<project>/opencode.json<project>/.opencode/plugins/arcroom.js
Network endpoints1
api.arcroomai.com
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The CLI runs initialization only when the user invokes the `init` command.
- Initialization configures ArcRoom hooks and writes agent settings for the current project.
- The client sends its saved API key as a bearer token to the configured API; the default host is `api.arcroomai.com`.
- The README discloses the prompt and activity data collected by the hooks, says file contents and tool output are not sent, and documents an `off` command.
Evidence against
- The manifest has a `prepublishOnly` script, which is not an install lifecycle hook.
- The flagged agent-configuration writes are part of the documented, explicitly invoked setup command.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
5 flaggeddist/fresh.jsView file
53const r = git(['ls-files', '--cached', '--others', '--exclude-standard'], { cwd, timeout: 1500 });
L54: files = r.status === 0 ? (r.stdout ?? '').split('\n').filter(Boolean).slice(0, MAX_SCAN) : [];
L55: return files;
Low
dist/init.jsView file
•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation.
const mcpfile = join(process.cwd(), '.mcp.json');
const mcpconfig = existssync(mcpfile) ? json.parse(readfilesync(mcpfile, 'utf8')) : {};
const local = addlocalmcp(entry);
if (local) {
if (string(mcpconfig.mcpservers?.arcroom?.args?.[0] ?? '').replaceall('\\', '/').includes(mark)) {
delete mcpconfig.mcpservers.arcroom;
writefilesync(mcpfile, json.stringify(mcpconfig, null, 2) + '\n');
}
}
else {
mcpconfig.mcpservers = { ...mcpconfig.mcpservers, arcroom: { command: node, args: [entry, 'mcp'] } };
writefilesync
High
Trigger Reachable External Ai Agent Control Surface Mutation
Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.
Findings
2 High2 Medium8 Low
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/init.js
HighPrevious Version Dangerous Deltadist/init.js
MediumNetwork
MediumEnvironment Vars
LowNon Install Lifecycle Scripts
LowScripts Present
LowWeak Cryptodist/fresh.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/init.js
Affected versions and remediation
This report applies to arcroom@0.0.2-beta.
See all versions of arcroom for other recorded verdicts.
- Review the evidence and your use of arcroom@0.0.2-beta before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.