{
  "$schema": "https://socket.dev/config/v0.json",
  "$comment": "Vanexa Agent declares only the capabilities it genuinely needs and suppresses nothing else. A previous wildcard packageRules block silenced every category for every transitive dependency; Amazon Inspector cited that file as evidence of concealment in MAL-2026-13397. Malware-intent detectors (aiMalware, gptMalware, usesEval, bypassesEnvironment, installScripts, typosquat) are deliberately LEFT ENABLED so their verdicts stay meaningful. Per-rule justifications are in socket.yml (shipped) and, in the public source repository, in SECURITY.md and docs/INFRASTRUCTURE.md, which enumerate every hardcoded endpoint. Those records are kept in the repo, not this tarball, which ships only V8 bytecode for source-IP protection.",
  "version": 2,
  "project": "@vanexalabs-ai/vanexa-agent",
  "issueRules": {
    "shellAccess": "ignore",
    "filesystemAccess": "ignore",
    "networkAccess": "ignore",
    "obfuscatedCode": "ignore",
    "obfuscatedFile": "ignore",
    "nativeCode": "ignore"
  }
}