@agentdock/daemon@0.0.102
PC daemon + CLI for AgentDock — ACP abstraction, TransportHandler, process management
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe daemon automatically uploads activity derived from local agent history, including project and transcript paths, to its configured server. This is a privacy-sensitive telemetry behavior, so warn rather than block; the reviewed code does not establish credential theft or an unrelated collector.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
The daemon starts and connects to a configured server; after its initial usage scan, it starts periodic uploads.
Impact
The server can learn local project directory and transcript path information without a clear per-user opt-in in the reviewed upload path.
Mechanism
The usage watcher derives activity from local agent history, including transcript paths and project directories, and the uploader posts the stats with a machine ID to the configured server.
AI rationale
The daemon automatically uploads activity derived from local agent history, including project and transcript paths, to its configured server. This is a privacy-sensitive telemetry behavior, so warn rather than block; the reviewed code does not establish credential theft or an unrelated collector.
Evidence
dist/globalUsageWatcher.jsdist/activityUploader.jsdist/daemonLoop.jsdist/daemonEntry.jsLocal agent transcript JSONL files discovered by the usage watcherDaemon stats-state.json
Network endpoints1
Configured AgentDock server URL + /v1/activity/upload
Decision evidence
public snapshotAI called this Suspicious at 84.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The usage watcher derives activity records containing local transcript file paths and project directories.
- The uploader sends activity statistics and a machine ID to the configured server’s `/v1/activity/upload` endpoint.
- The daemon starts periodic activity uploads after its initial scan when connected; the code does not show an explicit user opt-in gate.
- The upload destination comes from the daemon’s server endpoint, which may be configured or supplied by the package’s default brand settings.
Evidence against
- The manifest has no install lifecycle scripts; its CLI and import entry points are conventional for a daemon package.
- The process spawning, login autostart, and upgrade code support the package’s stated daemon purpose.
- The reviewed credential and upgrade paths did not show credentials being sent to an unrelated collector.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkShell
Source & flagged code
9 flaggeddist/triggerUpgradeRpc.jsView file
1"use strict";import{execSync as S}from"node:child_process";import{errorMessage as i,SOCKET_EVENTS as y}from"@agentdock/wire";import{triggerUpgrade as h,runPreflight as w,executeSwa...
High
Child Process
Package source references child process execution.
dist/triggerUpgradeRpc.jsView on unpkg · L1dist/upgradeCommand.jsView file
4`),await B(" Press Enter when ready... "));const r=await k(t,e);if(r.length===0){a("All sessions closed");return}p(`Stopping ${r.length} remaining session(s)...`);for(const o of r...
L5: `);v.writeFileSync(r,h,"utf-8"),D("cmd.exe",["/c",r],{detached:!0,stdio:"ignore",windowsHide:!0}).unref(),f(`Upgrade will complete after this process exits.
L6: `),process.exit(0)}function J(t,e){try{return i(`npm install -g ${s}@latest${t}`,{stdio:"inherit"}),a(`${s} upgraded successfully!`),i(`${g} --version`,{stdio:"inherit"}),!0}catch{...
High
Findings
1 Critical7 High4 Medium5 Low
CriticalPrevious Version Dangerous Deltadist/upgradeChild.js
HighChild Processdist/triggerUpgradeRpc.js
HighShelldist/upgradeCommand.js
HighSame File Env Network Executiondist/ensureDaemon.js
HighCommand Output Exfiltrationdist/ensureDaemon.js
HighTrigger Reachable Command Output Exfiltrationdist/ensureDaemon.js
HighTrigger Reachable Persistencedist/autostart.js
HighRuntime Package Installdist/triggerUpgrade.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/autostart.js
MediumStructural Risk Force Deep Review
Low
Affected versions and remediation
This report applies to @agentdock/daemon@0.0.102.
See all versions of @agentdock/daemon for other recorded verdicts.
- Review the evidence and your use of @agentdock/daemon@0.0.102 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.