registry / shepaw-acp-proxy-gateway / 0.1.2

shepaw-acp-proxy-gateway@0.1.2

Unified Shepaw gateway that connects to industry-standard ACP agents (Claude Code, Codex, CodeBuddy, etc.)

AI Security Review

scanned 21h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

No blocking static signals were detected.

Trigger

User runs `shepaw-acp-proxy serve` and configures a peer or tunnel.

Impact

An authorized remote peer or upstream agent can cause local commands and file access within the gateway host's permissions.

Mechanism

ACP proxy spawning local agents and servicing terminal/file requests

Rationale

No malicious installation, persistence, credential theft, or unconsented control-surface mutation was found. The package nevertheless exposes genuine remote-agent command and filesystem capability, warranting a warning as dangerous dual-use software.

Evidence

package.jsonREADME.mddist/index.jsdist/cli.js~/.claude/projects~/.codex/sessions~/.config/shepaw-acp-proxy-gateway

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

shepaw-acp-proxy-gateway@0.1.2

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code