agent-afk

Malware/supply-chain heuristics raised flags — review the signals before trusting this package.

• No malware layer produced data — package not deep-scanned for malware

Package comes from a trusted publisher with no typosquat signals.

• Published from CI with an SLSA provenance attestation
• 23 runtime dependencies — larger supply-chain attack surface

Only basic API-key auth is configured. OAuth or mTLS is stronger for production.

• Local stdio transport — no network exposure, but authentication cannot be verified from a static scan

Uses local stdio transport (low network exposure) but no wire encryption if exposed remotely.

• Local-only transport — low network exposure, but unencrypted and unsafe to tunnel remotely without TLS

Some tools can modify data or run sensitive operations — tighten policy around them.

• No tools detected

No attack data observed — static review only or no probe coverage.

• Static scan — no runtime attack data observed

Tool responses are not scanned for leaked secrets or PII — enable Response DLP.

• Response hygiene not verified for third-party package

Not proxied through Mastyf AI — no runtime policy enforcement or audit trail.

• Policy enforcement not observed — runtime policy and audit layer cannot be verified