@agent-link/agent@0.1.335
AgentLink local agent CLI
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package provides a real remote-control capability and persistence, so it warrants a warning. Source inspection ties these actions to explicit agent use and a guarded global migration path, not a covert install-time attack.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Run agentlink-client start and connect it to a relay.
Impact
A trusted or compromised relay can execute shell input and access or modify local user data through the running agent.
Mechanism
WebSocket-controlled shell, file operations, and user-level auto-start.
AI rationale
The package provides a real remote-control capability and persistence, so it warrants a warning. Source inspection ties these actions to explicit agent use and a guarded global migration path, not a covert install-time attack.
Evidence
dist/connection.jsdist/terminal.jsdist/auto-start.jsscripts/install-bridge.cjsdist/runtime-release.js~/.agentlink/config.json~/.config/systemd/user/agentlink.service~/Library/LaunchAgents/com.agentlink.agent.plist
Network endpoints2
wss://msclaude.aimsclaude.ai
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The package opens a WebSocket to its configured relay and dispatches received messages.
- Relay messages can open a shell and pass arbitrary terminal input to it.
- Starting the agent enables user-level auto-start by default after a healthy run.
- Global postinstall invokes a bridge that can fetch and stage a replacement runtime from msclaude.ai.
Evidence against
- The install hook runs only for global npm installs and the bridge proceeds only after an existing completed adoption state.
- The exposed remote-control and persistence functions are tied to the package's stated local-agent workflow; no covert credential harvesting or unrelated exfiltration was found.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
6 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/install-bridge.cjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgdist/emergency-upgrade.jsView file
4import { join, posix } from 'path';
L5: import { gunzipSync } from 'zlib';
L6: export const RELEASE_MANIFEST_URLS = {
L7: latest: 'https://msclaude.ai/files/agent/latest.json',
L8: beta: 'https://msclaude.ai/files/agent/beta.json',
...
L179: }
L180: if (normalizedPath === 'package/package.json') {
L181: if (packageIdentity) {
Low
Weak Crypto
Package source references weak cryptographic algorithms.
dist/emergency-upgrade.jsView on unpkg · L4launcher/launcher.cjsView file
7
Findings
4 High4 Medium6 Low
HighInstall Time Lifecycle Scriptspackage.json
HighTrigger Reachable Persistencedist/service.js
HighSemantic Analysis Limiteddist/cli.js#virtual:normalized:round1
HighPrevious Version Dangerous Deltadist/connection.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencelauncher/launcher.cjs
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowWeak Cryptodist/emergency-upgrade.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @agent-link/agent@0.1.335.
See all versions of @agent-link/agent for other recorded verdicts.
- Review the evidence and your use of @agent-link/agent@0.1.335 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.