arcroom@0.0.4-beta
Shared team memory and run control for coding agents: Claude Code, Codex, Cursor, OpenCode
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe package’s documented runtime capture is core to its purpose and is enabled through an explicit setup command. However, its events also include the machine hostname, which the README does not disclose, so the telemetry merits a warning.
Static reason
No blocking static signals were detected.
Trigger
After a user runs `arcroom init`, configured agent hooks record events during sessions and the daemon uploads them.
Impact
The API receives a machine identifier and workspace path that the README does not disclose, creating a limited privacy risk.
Mechanism
Events include hostname and working directory; queued events are sent to the ArcRoom ingest API.
AI rationale
The package’s documented runtime capture is core to its purpose and is enabled through an explicit setup command. However, its events also include the machine hostname, which the README does not disclose, so the telemetry merits a warning.
Evidence
README.mddist/events.jsdist/daemon.jsdist/home.jsdist/init.js~/.arcroom/spool.jsonl~/.arcroom/sent/
Network endpoints1
api.arcroomai.com/v1/ingest
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Each recorded event includes the machine hostname and current working directory.
- A user prompt is added to the event payload.
- The daemon uploads queued events to ArcRoom’s ingest API.
- The README discloses prompts, paths, and other recorded fields, but does not mention hostname collection.
- The hooks are configured by running the explicit `arcroom init` command.
Evidence against
- The only lifecycle script is `prepublishOnly`, which builds and tests; there is no install hook.
- The README describes the runtime collection, secret redaction, and `arcroom off` control.
- The README says file contents, tool output, and edit diffs are not sent.
- The credential is sent to the package’s own ArcRoom API.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
5 flaggeddist/fresh.jsView file
16* (one with a NUL byte) stays as it is. Every hash saved with steps or answers is taken over these bytes. */
L17: export const lf = (bytes) => (bytes.includes(0) ? bytes : Buffer.from(bytes.toString('latin1').replaceAll('\r\n', '\n'), 'latin1'));
L18: const MAX_SCAN = 2000; // files hashed when git's index has no match (no git, untracked files, CRLF committed)
...
L54: let index;
L55: const tracked = () => (index ??= new Map((git(['ls-files', '-s', '-z'], { cwd, timeout: 5000 }).stdout ?? '').split('\0').flatMap((e) => {
L56: const m = /^\d+ ([0-9a-f]{40,64}) \d\t([\s\S]+)$/.exec(e);
Low
dist/init.jsView file
•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation.
cp']) === 0;
}
function withoutourhooks(hooks) {
if (!hooks)
return hooks;
const ours = (h) => string(h?.command ?? '').includes(mark) || (h?.hooks ?? []).some((x) => string(x?.command ?? '').includes(mark));
const next = object.fromentries(object.entries(hooks).map(([event, list]) => [event, (list ?? []).filter((h) => !ours(h))]).filter(([, list]) => list.length));
return object.keys(next).length ? next : undefined;
}
Findings
2 High4 Medium6 Low
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/init.js
HighSemantic Analysis Limiteddist/done.js#virtual:normalized:round1
MediumNetwork
MediumEnvironment Vars
MediumAi Review Evidencedist/events.js
MediumAi Review Evidencedist/events.js
LowNon Install Lifecycle Scripts
LowScripts Present
LowWeak Cryptodist/fresh.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to arcroom@0.0.4-beta.
See all versions of arcroom for other recorded verdicts.
- Review the evidence and your use of arcroom@0.0.4-beta before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.