Refuted findings 11
Candidates the review stage examined and rejected, kept for transparency.
Persistence
highRefutedlow confidenceThe opt-in agent eval script writes an MCP config (.mcp.json) into a freshly created temp workspace so a spawned `claude` CLI loads the local uxloom server; the write is confined to a mkdtemp directory and does not touch the user's real agent config.
writeFileSync(join(ws, ".mcp.json"), JSON.stringify({Why it was refuted
Opt-in dev bench script writes .mcp.json only into a fresh mkdtemp workspace under tmpdir, never the user's real agent config, so there is no harm.
Persistence
highRefutedmedium confidenceThe `uxloom init` command writes the agent MCP config (.mcp.json) with an unpinned `npx -y uxloom` server entry and copies skill files into agent skill directories; this is undeclared in the MCP tool list, though disclosed in code comments and consistent with the init purpose.
const serverEntry = { command: "npx", args: ["-y", "uxloom"] };Why it was refuted
The `uxloom init` command is a user-invoked CLI whose documented purpose is to register the MCP server and install skills; it is not an undeclared write, and the entry points at the artifact's own package.
Persistence
highRefutedlow confidenceThe `uxloom init` command writes the MCP server registration into ./.mcp.json and installs skill files into agent directories (.claude/skills, .agents/skills), which are agent control-plane writes, though they are the documented purpose of the command.
registers the MCP server in ./.mcp.json (created or merged)
Why it was refuted
The writes are the documented core purpose of `uxloom init`, run only when the user invokes it, and are merge-only without overwriting.
Code execution
highRefutedlow confidenceloadPlaywright evaluates a fixed-literal dynamic import through `new Function` to load an optional Playwright module at runtime. The string is constant with no untrusted input, but the module is resolved from the local environment.
new Function('return import("playwright")')Why it was refuted
The Function body is a constant literal import of "playwright" with no untrusted input, disclosed in the file header; it fails silently when Playwright is absent.
Code execution
highRefutedlow confidencePlaywright is loaded via an indirect dynamic import built with `new Function(...)`, which evaluates a constructed string at runtime and loads whatever module resolves; the specifier is not visible in the shown unit.
`new Function("return import(...)")()`Why it was refuted
The shown function unit has a fixed literal specifier "playwright", and the mechanism is openly documented in the header; no constructed or attacker-controlled string.
Persistence
highRefutedlow confidenceThe design_audit tool lets the agent supply a scaffold path that is resolved relative to the project directory and written with JSON derived from design-export frame names. Any non-existing file path can be created, with no confinement to the workspace.
writeFileSync(out, JSON.stringify(result.scaffold, null, 2) + "\n");
Why it was refuted
The scaffold write is the declared capability of design_audit, refuses to overwrite existing files, and writes only the computed scaffold JSON.
Data exfiltration
highRefutedlow confidenceThe server makes an undeclared outbound network call to registry.npmjs.org for an update check (with a local cache in ~/.cache/uxloom), though it is disclosed in code comments, sends no local data, fails silently, and can be disabled via UXLOOM_NO_UPDATE_CHECK.
https://registry.npmjs.org/-/package/uxloom/dist-tags
Why it was refuted
A plain GET of the public npm dist-tags endpoint sends no local data, times out, caches only the version string, and fails silently; it is not exfiltration.
Supply chain
mediumRefutedlow confidenceThe install docs register the MCP server via `npx -y uxloom` with no version pin, so each launch runs whatever the latest published package is, auto-confirmed with -y; this is the artifact's own package and the documented install path.
claude mcp add uxloom -- npx -y uxloom
Why it was refuted
This is the artifact's own package in the documented fenced install instructions, a vendor-installer carve-out; it is not a hidden or third-party fetch.
Supply chain
mediumRefutedlow confidenceThe server loads Playwright at runtime via an indirect `new Function` dynamic import, so a module that is not declared or pinned in package.json is resolved from the user's environment and bypasses static analysis; this is disclosed, and the specifier is fixed.
new Function("return import(...)")()Why it was refuted
The optional Playwright load is explicitly documented (header and README), uses a fixed specifier, and degrades to null when absent; nothing is fetched or installed, so it is not a supply-chain concealment.
Agent hijacking
mediumRefutedlow confidenceThe comments_list tool description tells the agent that reviewer-supplied comments are its work queue and to act on them each session, so untrusted comment text becomes a possible prompt-injection channel, although this fits the tool's declared review workflow.
they are your work queue
Why it was refuted
The description merely documents the tool's declared reviewer-comment workflow; telling the agent to process comments is the core capability, not a hidden hijack instruction.
Supply chain
lowRefutedlow confidenceThe dev-only cold-start test launches the published package via an unpinned `uxloom@latest` through `npx -y`, which fetches and runs whatever the registry currently serves; this is the test's stated purpose, but it is unpinned remote code.
args: ["-y", "uxloom@latest"],
Why it was refuted
A dev-only test whose declared purpose is to launch the published package the way an agent's MCP config would; the unpinned latest is intentional and is not exposed to agents.
