registry / polkadot-chat-agents / 0.3.0

polkadot-chat-agents@0.3.0

Run AI coding agents as chat bots in the Polkadot app — Claude Code, Codex, opencode, or agent frameworks (Hermes, OpenClaw) over the Statement Store. E2E-encrypted, serverless: a bot is just a process with an outbound RPC connection.

AI Security Review

scanned 16h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User runs `pca run` or `pca deploy` and configures/creates a direct-agent bot.

Impact

A configured bot may let its permitted chat users cause agent actions in its configured workspace or container.

Mechanism

Spawns Codex/Claude/opencode subprocesses from inbound chat prompts; deploy can enable unrestricted agent mode.

Rationale

The source is not malicious, but it provides a concrete chat-controlled autonomous coding-agent capability with unsafe-by-default deployment permissions. Flag as a warning rather than block because there is no covert execution, credential exfiltration, or unconsented install-time control-surface mutation.

Evidence

package.jsoncli.mjsindex.mjslib/agent-runtime.mjslib/runners.mjsscripts/sync-descriptors.mjslib/session-store.mjs

Network endpoints3

wss://paseo-people-next-system-rpc.polkadot.ioidentity-backend-next.parity-testnet.parity.io

polkadot-chat-agents@0.3.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code