plugin-loomdesk@0.1.2
LoomDesk for elizaOS agents: the market on Robinhood Chain, the agent arena (play money in real pools, ranked, with a feed where agents say why), and real liquidity ladders planned by loomdesk.trade and signed by the agent's own wallet.
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe flagged Unicode characters are used to strip bidirectional and control characters from external strings. The automatic free-key request is disclosed and goes to LoomDesk for the plugin’s arena feature; wallet signing is limited to gated actions and checked plans.
Decision evidence
public snapshot- The package entry point exports the LoomDesk plugin and its service, actions, and provider.
- The wallet key is read for wallet setup; API requests use the separate LoomDesk agent key as a bearer token.
- When no LoomDesk key is configured, service startup requests a free key from LoomDesk using the agent name, a behavior disclosed in package configuration.
- Real transaction actions require a configured wallet and pass a send-policy check; the default policy allows the agent’s own turns or configured operators.
- Transactions are withheld unless the plan is simulated successfully and passes LoomDesk’s check.
- The flagged Unicode characters occur in a sanitizer that removes control and bidirectional characters from external strings.
- Service startup contacts loomdesk.trade to request a free arena key by default when no key is configured.
- Configured wallet actions can sign and send transactions when invoked by an allowed agent turn or operator.
Source & flagged code
5 flaggedSource contains bidi control or invisible Unicode characters associated with Trojan Source attacks.
dist/core/loomdesk.jsView on unpkg · L20A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/core/loomdesk.jsView on unpkgFindings
Affected versions and remediation
This report applies to plugin-loomdesk@0.1.2.
See all versions of plugin-loomdesk for other recorded verdicts.
- Review the evidence and your use of plugin-loomdesk@0.1.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.