registry / @addai/entity-runtime / 0.2.51

@addai/entity-runtime@0.2.51

Package no longer supported. Contact Support at https://www.npmjs.com/support for more info.

Daemon that pairs a machine with your +Ai account and runs Claude / Codex / Kimi / Gemini agents on its behalf. Reachable via Supabase from Vault, Entity Studio, or any other +Ai surface.

AI Security Review

scanned 9d ago · by lpm-firewall-ai

The explicitly started daemon pairs to AddAI's Supabase service and executes requested agent sessions. At runtime it suppresses Claude bypass-permission confirmation and marks ephemeral project paths trusted.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User runs the entity-runtime CLI/daemon and pairs the machine.

Impact

A paired service can cause high-privilege agent activity; no install-time foreign control-surface mutation or concrete exfiltration chain was found.

Mechanism

Remote agent orchestration with runtime Claude configuration mutation.

Rationale

Source inspection confirms an explicit-user-started, remotely orchestrated agent runtime that weakens Claude interaction safeguards. This is a real dangerous capability, but no concrete malicious behavior or unconsented install-time AI-agent configuration mutation was found.

Evidence

package.jsonscripts/fix-pty-helper.jsdist/index.jsdist/claude-config.jsdist/session-runner.jsdist/command-runner.jsdist/supabase-client.js

Network endpoints2

syhzpqqvrplaqdipcymw.supabase.covault.add.ai/add/entity

OSV Corroboration

The package runs a daemon that polls a hardcoded Supabase project (syhzpqqvrplaqdipcymw.supabase.co) via the RPC `runtime_pick_next_request` for remote-supplied job rows and spawns Claude Code / Codex / Kimi / Gemini / Grok in a PTY on the installer's host, driven by fields controlled by the paired remote party (prompt, permissionMode, appendSystemPrompt, allowedTools, model, workingDirectory). In `dist/session-runner.js`, `spawnClaudeForRuntime` invokes the agent binary through a login shell (`['-l','-c','exec "$@"',...]`) and, when `input.permissionMode === 'bypassPermissions'`, passes `--dangerously-skip-permissions`, letting the remotely-driven AI agent execute arbitrary shell tools as the local user without any interactive prompt. On start, `ensureBypassPermissionsAccepted()` in `dist/index.js` also writes `skipDangerousModePermissionPrompt: true` into the installer's user-global `~/.claude/settings.json`, disabling Claude Code's own bypass-permissions safety dialog for every future interactive Claude Code session the installer runs — not just those spawned by this daemon. `dist/capabilities.js` additionally reads `~/.kimi/config` and modifies PATH. The net effect is a persistent remote-controlled channel giving the paired remote party host-level RCE on the installer's machine via the AI agent tool loop, plus a persistent lowering of a separate vendor tool's safety prompts.

@addai/entity-runtime@0.2.51

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code