registry / nexus-coder / 1.1.3

nexus-coder@1.1.3

NexusAgent - A powerful LLM Code Agent with MCP, Skills, and ACP support

AI Security Review

scanned 17h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. On explicit CLI runtime, the package imports Claude Code configuration into its own directory and can auto-start the imported MCP commands. It dynamically loads user-local skill modules.

Static reason

No blocking static signals were detected.

Trigger

User runs nexus/agent; first run with ~/.claude.json present, then agent initialization.

Impact

Existing local agent extensions can gain this agent's tool-capable runtime.

Mechanism

auto-imported MCP command execution and dynamic local skill loading

Rationale

Source inspection found a concrete first-party agent-extension import and execution path, not malware behavior. Warn rather than block under the lifecycle policy.

Evidence

dist/src/config/index.jsdist/src/config/claude-import.jsdist/src/mcp/client-manager.jsdist/src/skills/loader.jsdist/src/mcp/builtin-tools.jspackage.json~/.claude.json~/.claude/skills/~/.nexus/config.json~/.nexus/skills/

Network endpoints1

api.open-meteo.com/v1/forecast

nexus-coder@1.1.3

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code