registry / reevesagents / 1.3.2

reevesagents@1.3.2

Local tmux-first workspace manager for AI CLI agents

AI Security Review

scanned 17h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

No blocking static signals were detected.

Trigger

User runs `reevesagents attach` or an attached MCP client invokes `attach_host`.

Impact

A host AI CLI gains this package's agent-control tools; this is an explicit, first-party extension setup rather than install-time hijacking.

Mechanism

Host-CLI MCP registration and local tmux process orchestration.

Rationale

Source inspection found an explicit AI-agent extension and orchestration capability but no lifecycle-triggered mutation, exfiltration, remote payload execution, or stealth persistence. Warn because attachment broadens an AI CLI control surface when deliberately invoked.

Evidence

package.jsondist/cli.jsdist/chunk-VTLLF2Z4.jsdist/server-I2ROVLSH.jsdist/chunk-36SYE7IU.jsdist/server-Y4HMP3OI.js

Network endpoints1

127.0.0.1

Decision evidence

public snapshot

AI called this at 89.0% confidence with false-positive risk.

reevesagents@1.3.2

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code