registry / getcanopy / 0.2.2

getcanopy@0.2.2

Veyr terminal CLI — usage/cost, Graphify graph status, and agent guidance rules, read from local Veyr data. No proxy, no account.

AI Security Review

scanned 9h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

No blocking static signals were detected.

Trigger

User runs `veyr rules on`, `veyr rules enable`, `veyr compose`, or `veyr graph --refresh`.

Impact

Can enable package-owned agent guidance through the companion app; no unconsented broad control-surface write or exfiltration was confirmed.

Mechanism

Explicit local Veyr configuration mutation and loopback daemon client.

Rationale

Source inspection found an explicit, first-party agent-guidance configuration capability rather than concrete malicious behavior. Per policy, this warrants a warning classification for explicit user-command agent config mutation, not a publish block.

Evidence

package.jsondist/index.jsdist/commands/rules.jsdist/commands/style.jsdist/commands/compose.jsdist/veyr/daemon.js~/.veyr/config.json~/.veyr/guidance-rules.json~/.veyr/daemon.json~/.veyr/agent-status/VEYR_STATUS.json~/.veyr/cache/graph.json

Network endpoints1

127.0.0.1

getcanopy@0.2.2

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code