mtech-ai-local-runner@0.1.68
⚠ Under reviewAn answer to a colleague ask now goes first to the session that made the ask, when the asking AI passed its client session id (Work Item e1c08b33). Among the sessions an answer names, the runner takes the one listed first, as long as a person typed in it
AI Security Review
scanned 7d ago · by lpm-firewall-aiThe inspected integration hooks are reached through user-invoked CLI commands, and no concrete attack was verified. The two shipped native executables remain behaviorally unresolved, so the package cannot be cleared from static source inspection alone.
Decision evidence
public snapshot- The offline analysis could not identify the format or behavior of the shipped Codex observer executable; its behavior remains unresolved.
- The offline analysis could not identify the format or behavior of the shipped policy observer executable; its behavior remains unresolved.
- Integration hooks are installed through an explicit CLI command for selected apps; the install function writes those integrations.
- The manifest exposes a CLI and lists build and user-facing command scripts.
- The inspected integration path is user-invoked; it does not establish an attack.
- No concrete malicious behavior was verified in the inspected source.
Source & flagged code
5 flaggedPackage text addresses the security reviewer or scanner and tries to influence the review outcome.
README.mdView on unpkgPackage source references dynamic require/import behavior.
dist/src/adapters/codex/pre-model-gate.jsView on unpkg · L29Findings
Affected versions and remediation
This report applies to mtech-ai-local-runner@0.1.68.
See all versions of mtech-ai-local-runner for other recorded verdicts.
- Review the evidence and your use of mtech-ai-local-runner@0.1.68 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.