registry / claudelink / 1.5.0

claudelink@1.5.0

The hub where your AI agents connect. Multi-terminal Claude Code agent communication via MCP.

AI Security Review

scanned 3h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

No blocking static signals were detected.

Trigger

User runs `claudelink init`/global setup or `claudelink install-hooks`, then starts the configured service.

Impact

Configured agents can receive injected inbox/recovery prompts and altered coordination instructions; no unconsented install-time mutation or exfiltration is established.

Mechanism

Explicit AI-agent extension setup plus terminal-input automation

Rationale

The package is not malicious under the stated boundary because its sensitive AI-agent mutations require explicit CLI setup rather than npm lifecycle execution. Its broad agent-control and terminal-automation capability warrants a warning.

Evidence

package.jsondist/cli.jsdist/scheduler.jsdist/recovery-watcher.jsdist/hooks/stop-hook.jsdist/ui-launcher.js~/.claudelink/nexus.db~/.claude/settings.json~/.claude/CLAUDE.md~/.codex/AGENTS.md~/.gemini/settings.json~/.config/goose/config.yaml

Network endpoints1

127.0.0.1

claudelink@1.5.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code