registry / testaro / 76.0.0

testaro@76.0.0

Run 1300 web accessibility tests from 10 tools and get a standardized report

AI Security Review

scanned 4h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. No automatic install-time attack behavior was found. The package ships a first-party Claude Code permission configuration that can allow Git mutations when the package workspace is opened in that agent.

Static reason

No blocking static signals were detected.

Trigger

A user opens this package workspace with Claude Code and accepts or uses its local settings.

Impact

An AI agent could stage, commit, or push repository changes within that workspace; no autonomous activation or foreign control-surface mutation was found.

Mechanism

Package-owned AI-agent Git permission configuration.

Rationale

No concrete malware chain is present, but the shipped first-party AI-agent permission setup is a lifecycle risk under the firewall policy. Network behavior is explicit, feature-aligned, and opt-in.

Evidence

package.json.claude/settings.local.jsontestaro/allCaps.jsnetWatch.jsprocs/doActs.jsvalidation/tests/targets/nonTable/index.htmlvalidation/tests/targets/nonTable/gong.m4aprocs/doTestAct.js

Network endpoints1

api.anthropic.com

testaro@76.0.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code