arcroom@0.0.5-beta
Shared team memory and run control for coding agents: Claude Code, Codex, Cursor, OpenCode
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe entry point runs the requested command, and agent settings are changed through the explicit init flow. Runtime event collection is disclosed as the package’s shared-memory function and is sent to the ArcRoom API.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A user runs arcroom init to configure an agent; configured hooks and the daemon then operate during agent sessions.
Impact
The service receives disclosed prompt excerpts and activity metadata for the package’s core function; the README says file contents, tool output and edit diffs are not sent.
Mechanism
The hooks queue documented, redacted run events, and the daemon sends them to the configured ArcRoom API using the saved ArcRoom key.
AI rationale
The entry point runs the requested command, and agent settings are changed through the explicit init flow. Runtime event collection is disclosed as the package’s shared-memory function and is sent to the ArcRoom API.
Evidence
~/.arcroom/runtime~/.claude/settings.json.claude/settings.local.json.mcp.json
Network endpoints2
api.arcroomai.com127.0.0.1
Decision evidence
public snapshotAI called this Clean at 96.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The only lifecycle script is prepublishOnly, which builds and tests; the entry point dispatches actions based on a command the user supplied.
- Agent configuration changes are performed by the explicit init command; laptop-wide hooks require the explicit --everywhere option.
- The default API is api.arcroomai.com, and the client sends requests using the configured ArcRoom key.
- The README describes the runtime data collected and sent, including prompt excerpts, paths and shell commands, and states that file contents, tool output and edit diffs are not sent.
- The daemon uploads queued events to the ArcRoom ingest endpoint as part of the package’s shared-memory and run-recording function.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
5 flaggeddist/fresh.jsView file
16* (one with a NUL byte) stays as it is. Every hash saved with steps or answers is taken over these bytes. */
L17: export const lf = (bytes) => (bytes.includes(0) ? bytes : Buffer.from(bytes.toString('latin1').replaceAll('\r\n', '\n'), 'latin1'));
L18: const MAX_SCAN = 2000; // files hashed when git's index has no match (no git, untracked files, CRLF committed)
...
L54: let index;
L55: const tracked = () => (index ??= new Map((git(['ls-files', '-s', '-z'], { cwd, timeout: 5000 }).stdout ?? '').split('\0').flatMap((e) => {
L56: const m = /^\d+ ([0-9a-f]{40,64}) \d\t([\s\S]+)$/.exec(e);
Low
dist/init.jsView file
•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation.
cp']) === 0;
}
function withoutourhooks(hooks) {
if (!hooks)
return hooks;
const ours = (h) => string(h?.command ?? '').includes(mark) || (h?.hooks ?? []).some((x) => string(x?.command ?? '').includes(mark));
const next = object.fromentries(object.entries(hooks).map(([event, list]) => [event, (list ?? []).filter((h) => !ours(h))]).filter(([, list]) => list.length));
return object.keys(next).length ? next : undefined;
}
Findings
3 High2 Medium7 Low
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/init.js
HighSemantic Analysis Limiteddist/done.js#virtual:normalized:round1
HighPrevious Version Dangerous Deltadist/init.js
MediumNetwork
MediumEnvironment Vars
LowNon Install Lifecycle Scripts
LowScripts Present
LowWeak Cryptodist/fresh.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
Affected versions and remediation
This report applies to arcroom@0.0.5-beta.
See all versions of arcroom for other recorded verdicts.
- Review the evidence and your use of arcroom@0.0.5-beta before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.