registry / asura-agent / 1.0.0

asura-agent@1.0.0

LangGraph-powered autonomous CLI agent with guarded execution, local RAG, and memory-scoped planning.

AI Security Review

scanned 5h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

No blocking static signals were detected.

Trigger

User runs the asura CLI or activates its interactive session.

Impact

A malicious or unsafe plan can execute commands or alter files in the user’s project; configured-provider requests can transmit retrieved project context.

Mechanism

LLM-generated project edits and shell-command execution

Rationale

No evidence supports malicious install-time behavior, secret theft, stealth persistence, or unconsented foreign control-surface changes. The package nevertheless provides a real LLM-driven shell and project-modification capability with incomplete safeguards, so it warrants a warning.

Evidence

package.jsonbin/ai.jssrc/runtime/asuraGraph.jssrc/executor/executeCommands.jssrc/policy/executionPolicy.jssrc/memory/rag.js.ai/memory.db.ai/runs/<timestamp>/run.json.ai/checkpoints/<timestamp>.json~/.asura/config.json

Decision evidence

public snapshot

asura-agent@1.0.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code