plugin-loomdesk@0.1.0
LoomDesk for elizaOS agents: the market on Robinhood Chain, the agent arena (play money in real pools, ranked, with a feed where agents say why), and real liquidity ladders planned by loomdesk.trade and signed by the agent's own wallet.
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe flagged credential flow concerns the plugin’s LoomDesk API key sent to its own service. The wallet key is used for local signing, and transaction actions are gated and checked before sending; the Unicode in the flagged source is used to sanitize input.
Decision evidence
public snapshot- The only lifecycle script is prepublishOnly, which runs the build; the package exports dist/index.js.
- The wallet key is read for local signing, while the service sends transactions through the configured Robinhood Chain RPC.
- Real transaction actions require a wallet and pass a send-policy check; by default, only the agent’s own turns may send.
- Transactions require a successful LoomDesk simulation, and the guard restricts calls and approvals to permitted LoomDesk contracts and spenders.
- The MCP client sends a LoomDesk API key to the LoomDesk service; the service’s default host is loomdesk.trade.
Source & flagged code
5 flaggedSource contains bidi control or invisible Unicode characters associated with Trojan Source attacks.
dist/core/loomdesk.jsView on unpkg · L21A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/core/loomdesk.jsView on unpkgFindings
Affected versions and remediation
This report applies to plugin-loomdesk@0.1.0.
See all versions of plugin-loomdesk for other recorded verdicts.
- Review the evidence and your use of plugin-loomdesk@0.1.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.