registry / @agent-qofeno/agentx-cli / 3.0.2

@agent-qofeno/agentx-cli@3.0.2

To install dependencies:

AI Security Review

scanned 3h ago · by lpm-firewall-ai

The high-risk scanner findings were not confirmed in the inspected source: the manifest shows no install hook, the installer fallback disables dependency scripts, and the language-server excerpt shows a project-scoped stdio launch. No concrete attack behavior was established.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

The CLI is launched, or a language server is requested for a project.

Impact

No malicious impact is established by the inspected source.

Mechanism

The inspected code selects and verifies a platform binary and starts language servers for project files; it does not establish an unrelated data transfer or other attack behavior.

AI rationale

Decision evidence

public snapshot

AI called this Clean at 92.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The package manifest lists development and test scripts and a CLI entry point, with no install lifecycle script in the inspected script and entry-point sections.
The installer fallback fetches a platform binary with dependency scripts disabled, then verifies it by running its version command.
The inspected language-server code launches a server over standard I/O from a project root; no unrelated command-output transfer is established by these excerpts.
The first manifest identifies the dependency as @agentclientprotocol/sdk version 0.21.0.
The ACP distribution defines a client-side connection class for communication with an agent.
The second manifest identifies @ai-sdk/openai-compatible and points its ESM module entry to dist/index.mjs.
The OpenAI-compatible factory accepts a configured baseURL and apiKey as options.
The third manifest identifies @ai-sdk/provider and points its ESM module entry to dist/index.mjs.

Evidence against

Behavioral surface

Source

ChildProcessCryptoDynamicRequire

Source & flagged code

4 flagged

script/postinstall.mjsView file

Lines 1-22javascript

1#!/usr/bin/env node

3import childProcess from "child_process"

4import fs from "fs"

High

Child Process

Package source references child process execution.

script/postinstall.mjsView on unpkg · L2

5import os from "os"

6import path from "path"

7import { createRequire } from "module"

8import { fileURLToPath } from "url"

10const __dirname = path.dirname(fileURLToPath(import.meta.url))

11const require = createRequire(import.meta.url)

12const packageJson = JSON.parse(fs.readFileSync(path.join(__dirname, "package.json"), "utf8"))

14const platformMap = {

15 darwin: "darwin",

16 linux: "linux",

17 win32: "windows",

18}

19const archMap = {

20 x64: "x64",

21 arm64: "arm64",

22 arm: "arm",

script/time.tsView file

Lines 1-7typescript

1#!/usr/bin/env bun

3import path from "path"

4const toDynamicallyImport = path.join(process.cwd(), process.argv[2])

5await import(toDynamicallyImport)

src/lsp/server.tsView file

Lines 1-21typescript

1import type { ChildProcessWithoutNullStreams } from "child_process"

2import path from "path"

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

src/lsp/server.tsView on unpkg · L1

3import os from "os"

Source & flagged code

4 flagged · loading source

script/postinstall.mjsView file

2L3: import childProcess from "child_process" L4: import fs from "fs"

High

Child Process

Package source references child process execution.

script/postinstall.mjsView on unpkg · L2

script/time.tsView file

4const toDynamicallyImport = path.join(process.cwd(), process.argv[2]) L5: await import(toDynamicallyImport) L6: console.log(performance.now())

Medium

Dynamic Require

Package source references dynamic require/import behavior.

script/time.tsView on unpkg · L4

src/lsp/server.tsView file

•bounded command output exfiltration = }\n\n const parentdir = path.dirname(currentdir)\n if (parentdir === currentdir) break \n currentdir = parentdir\n\n \n if (!currentdir.startswith(ctx.worktree)) break\n }\n\n return crateroot\n },\n extensions: [".rs"],\n async spawn(root) {\n const bin = which("rust-analyzer")\n if (!bin) {\n return\n }\n return {\n process: spawn(bin, {\n cwd: root,\n }),\n }\n },\n}\n\nexport const clangd: info = {\n id: "clangd",\n root: nearestroot(["compile_commands.json", "compile_flags.txt", ".clangd"]),\n extensions: [".c", ".cpp", ".cc", ".cxx", ".c++", ".h", ".hpp", ".hh", ".hxx", ".h++"],\n async spawn(root, _ctx, fl

Findings

1 Critical3 High4 Medium5 Low

CriticalCommand Output Exfiltrationsrc/lsp/server.ts

HighChild Processscript/postinstall.mjs

HighShell

HighSandbox Evasion Gated Capabilitysrc/lsp/server.ts

MediumDynamic Requirescript/time.ts

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowEval

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @agent-qofeno/agentx-cli@3.0.2.

See all versions of @agent-qofeno/agentx-cli for other recorded verdicts.

Review the evidence and your use of @agent-qofeno/agentx-cli@3.0.2 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-23 02:02:15.262Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.