plugin-loomdesk@0.1.1
LoomDesk for elizaOS agents: the market on Robinhood Chain, the agent arena (play money in real pools, ranked, with a feed where agents say why), and real liquidity ladders planned by loomdesk.trade and signed by the agent's own wallet.
AI Security Review
scanned 4d ago · by lpm-firewall-aiThis plugin's default send policy authorizes autonomous agent turns, and its real liquidity actions sign and submit transactions from a configured private-key wallet. The caps and simulation checks limit risk, but do not prevent automated spending without a user request.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
An agent autonomous turn invokes one of the real liquidity sending actions while a wallet key is configured.
Impact
The agent can spend configured amounts without a contemporaneous user request; the package defines per-plan caps of 0.01 ETH and 25 USDG by default.
Mechanism
The default policy treats autonomous messages as eligible to sign; the service constructs a wallet from LOOMDESK_PRIVATE_KEY or EVM_PRIVATE_KEY, then sends planned transactions through the configured Robinhood Chain RPC.
Attack narrative
When configured with a private key, the plugin allows agent-authored autonomous messages to pass its default send policy. If an autonomous turn invokes a real liquidity action, the plugin signs and submits the planned transaction through the configured chain RPC, spending the wallet's funds without a contemporaneous user request. Default spending caps and plan checks limit exposure but do not require explicit approval for each transaction.
AI rationale
This plugin's default send policy authorizes autonomous agent turns, and its real liquidity actions sign and submit transactions from a configured private-key wallet. The caps and simulation checks limit risk, but do not prevent automated spending without a user request.
Evidence
dist/config.jsdist/service.jsdist/actions.jsdist/core/loomdesk.js
Network endpoints2
loomdesk.traderpc.mainnet.chain.robinhood.com
Decision evidence
public snapshotAI called this Malicious at 91.0% confidence as Malware with low false-positive risk.
Evidence for block
- The default send policy is "agent", and messages marked as autonomous count as eligible to sign.
- At service startup, a supplied private key is turned into a wallet sender on the configured Robinhood Chain RPC.
- The actions can submit transactions through that sender; the plugin's purpose includes real liquidity positions.
- A startup request for a free key sends the character name to LoomDesk's own API and is documented in the package configuration.
- The flagged Unicode range is used to strip control and bidirectional characters from server and user strings.
- The only lifecycle script is prepublishOnly, which runs the build.
Evidence against
- Real-wallet sending requires the operator to supply a private key; without it the plugin says it can only plan.
- Sending actions check the configured policy, and the default only permits agent-authored or autonomous messages.
- The source documents spend caps and simulation checks before sending.
- The free-key request targets LoomDesk's own API and sends the character name, not credentials or project data.
Behavioral surface
Source & flagged code
5 flaggeddist/core/loomdesk.jsView file
21contains invisible/control Unicode U+202A (left-to-right embedding)
const UNSAFE = /[\u0000-\u001f\u007f<U+200B>-<U+200F><U+202A>-<U+202E><U+2066>-<U+2069>]/g;
Critical
Trojan Source Unicode
Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.
dist/core/loomdesk.jsView on unpkg · L21•Trigger-reachable chain: manifest.main -> dist/index.js -> dist/config.js -> dist/core/index.js -> dist/core/loomdesk.js
Reachable file contains a blocking source-risk pattern.
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/core/loomdesk.jsView on unpkg336let paid = 0n;
for (const tx of txs) {
let r;
try {
r = await s.send(tx);
}
catch (e) {
High
Ai Review Evidence
The actions can submit transactions through that sender; the plugin's purpose includes real liquidity positions.
Findings
2 Critical3 High3 Medium4 Low
CriticalTrojan Source Unicodedist/core/loomdesk.js
CriticalTrigger Reachable Dangerous Capabilitydist/core/loomdesk.js
HighAi Review Evidencedist/config.js
HighAi Review Evidencedist/service.js
HighAi Review Evidencedist/core/loomdesk.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to plugin-loomdesk@0.1.1.
See all versions of plugin-loomdesk for other recorded verdicts.
- Avoid installing plugin-loomdesk@0.1.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.