registry / @agentskit/cli / 0.13.14

@agentskit/cli@0.13.14

CLI for AgentsKit chat and project scaffolding.

AI Security Review

scanned 2h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

User runs `agentskit chat`/`run` with selected tools or user-controlled AgentsKit configuration/plugins.

Impact

A user who enables or supplies untrusted agent configuration/plugins/tasks can cause local command execution and data exposure through those configured capabilities.

Mechanism

User-configured agent runtime executes shell, MCP, plugin, and filesystem capabilities.

Rationale

Source inspection contradicts the scanner's claimed credential exfiltration: provider keys are used for requested provider requests, not an unrelated collector. The shipped CLI nevertheless provides high-impact local agent execution primitives, so it should warn rather than block.

Evidence

package.jsondist/bin.jsdist/chunk-RNOYLQCV.jsdist/index.cjs~/.agentskit/config.ts~/.agentskit/config.json~/.agentskit/plugins./.agentskit.config.ts./.agentskit.config.json./.agentskit/components.json./.agentskit-history.json./.agentskit-rag/store.json

Network endpoints3

api.openai.comregistry.agentskit.ioraw.githubusercontent.com/AgentsKit-io/agentskit-registry/v1/schema/components.json

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

`dist/chunk-RNOYLQCV.js` runs configured shell hooks via `sh -c`.
`dist/chunk-RNOYLQCV.js` spawns configured MCP server commands with inherited environment.
`dist/chunk-RNOYLQCV.js` auto-imports JavaScript/TypeScript plugins from `~/.agentskit/plugins` during `chat`.
`chat`/`run` expose filesystem and shell tools to selected LLM agent workflows.

Evidence against

`package.json` has no preinstall, install, postinstall, or prepare lifecycle hook.
`dist/bin.js` only parses explicitly invoked CLI arguments.
Environment API keys are passed to selected provider adapters, not sent to an unrelated hard-coded endpoint.
Network use is feature-aligned: provider embeddings and the AgentsKit component registry.
Config writes occur only through explicit `agentskit config init` or scaffold/add commands.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 5 file(s), 575 KB of source, external domains: api.anthropic.com, api.openai.com, generativelanguage.googleapis.com, github.com, nodejs.org, ollama.com, openrouter.ai, raw.githubusercontent.com, registry.agentskit.io, www.agentskit.io

Source & flagged code

5 flagged

dist/chunk-RNOYLQCV.jsView file

Lines 1-58javascript

1#!/usr/bin/env node

2import { readdir, stat, mkdir, writeFile, glob, readFile } from 'fs/promises';

3import { homedir } from 'os';

4import path, { join, resolve, isAbsolute, basename, dirname, sep } from 'path';

5import { kimi, grok, deepseek, ollama, gemini, anthropic, openai } from '@agentskit/adapters';

6import { randomBytes, createHash } from 'crypto';

7import { writeFileSync, existsSync, readdirSync, statSync, readFileSync, mkdirSync, rmSync } from 'fs';

8import { spawn } from 'child_process';

9import React2, { useMemo, useState, useEffect, useRef } from 'react';

High

Child Process

Package source references child process execution.

dist/chunk-RNOYLQCV.jsView on unpkg · L7

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist/chunk-RNOYLQCV.jsView on unpkg · L7

10import { Box, Text, render } from 'ink';

11import { useChat, StatusHeader, ChatContainer, Message, ToolCallView, ToolConfirmation, ThinkingIndicator, InputBar } from '@agentskit/ink';

12import { shell, filesystem, fetchUrl, webSearch } from '@agentskit/tools';

13import { summarizer, critic, planner, coder, researcher, composeSkills } from '@agentskit/skills';

14import { fileVectorMemory, fileChatMemory, sqliteChatMemory } from '@agentskit/memory';

15import { getIntegration, integrationToolsFromEnv } from '@agentskit/integrations';

16import { jsxs, jsx } from 'react/jsx-runtime';

17import { pathToFileURL } from 'url';

18import { createRuntime, validateFlow, flowToMermaid, compileFlow, createFileStepLog } from '@agentskit/runtime';

19import chokidar from 'chokidar';

20import kleur3 from 'kleur';

21import { createRAG } from '@agentskit/rag';

22import { Command } from 'commander';

23import { input, select, checkbox, confirm } from '@inquirer/prompts';

24import { validateAgentSchema } from '@agentskit/core/agent-schema';

25import { parse } from 'yaml';

26import { validatePIITaxonomy } from '@agentskit/core/security';

27import { ConfigError, ErrorCodes } from '@agentskit/core';

29async function loadJsonConfig(path5) {

30 try {

31 const raw = await readFile(path5, "utf8");

32 return JSON.parse(raw);

33 } catch {

34 return void 0;

35 }

36}

37async function loadTsConfig(path5) {

38 try {

39 const mod = await import(path5);

40 return mod.default ?? mod;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/chunk-RNOYLQCV.jsView on unpkg · L38

41 } catch {

42 return void 0;

43 }

44}

45async function loadPackageJsonConfig(dir) {

46 try {

47 const raw = await readFile(join(dir, "package.json"), "utf8");

48 const pkg = JSON.parse(raw);

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/chunk-RNOYLQCV.jsView on unpkg · L7

49 if (pkg.agentskit && typeof pkg.agentskit === "object") {

50 return pkg.agentskit;

51 }

52 return void 0;

53 } catch {

54 return void 0;

55 }

56}

57function mergeConfigs(base, override) {

58 if (!base && !override) return void 0;

dist/index.cjsView file

Lines 1-37javascript

1#!/usr/bin/env node

2'use strict';

4var commander = require('commander');

5var React2 = require('react');

6var ink$1 = require('ink');

7var promises

Source & flagged code

5 flagged · loading source

dist/chunk-RNOYLQCV.jsView file

7import { writeFileSync, existsSync, readdirSync, statSync, readFileSync, mkdirSync, rmSync } from 'fs'; L8: import { spawn } from 'child_process'; L9: import React2, { useMemo, useState, useEffect, useRef } from 'react'; ... L31: const raw = await readFile(path5, "utf8"); L32: return JSON.parse(raw); L33: } catch { ... L46: try { L47: const raw = await readFile(join(dir, "package.json"), "utf8"); L48: const pkg = JSON.parse(raw); ... L78: if (home === null) return void 0; L79: const globalDir = join(home ?? homedir(), ".agentskit"); L80: const tsConfig = await loadTsConfig(join(globalDir, "config.ts"));

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/chunk-RNOYLQCV.jsView on unpkg · L7

High

Child Process

Package source references child process execution.

dist/chunk-RNOYLQCV.jsView on unpkg · L7

7import { writeFileSync, existsSync, readdirSync, statSync, readFileSync, mkdirSync, rmSync } from 'fs'; L8: import { spawn } from 'child_process'; L9: import React2, { useMemo, useState, useEffect, useRef } from 'react'; ... L112: defaultModel: "llama3.1", L113: factory: (c) => ollama({ model: c.model, baseUrl: c.baseUrl }) L114: }, ... L226: try { L227: return JSON.parse(readFileSync(path5, "utf8")); L228: } catch {

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist/chunk-RNOYLQCV.jsView on unpkg · L7

38try { L39: const mod = await import(path5); L40: return mod.default ?? mod;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/chunk-RNOYLQCV.jsView on unpkg · L38

dist/index.cjsView file

17Trigger-reachable chain: manifest.main -> dist/index.cjs L17: var integrations = require('@agentskit/integrations'); L18: var child_process = require('child_process'); L19: var jsxRuntime = require('react/jsx-runtime'); ... L40: const raw = await promises.readFile(path5, "utf8"); L41: return JSON.parse(raw); L42: } catch { ... L55: try { L56: const raw = await promises.readFile(path.join(dir, "package.json"), "utf8"); L57: const pkg = JSON.parse(raw); ... L87: if (home === null) return void 0; L88: const globalDir = path.join(home ?? os.homedir(), ".agentskit"); L89: const tsConfig = await loadTsConfig(path.join(globalDir, "config.ts"));

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.cjsView on unpkg · L17

Findings

2 Critical3 High4 Medium4 Low

CriticalCredential Exfiltrationdist/chunk-RNOYLQCV.js

CriticalTrigger Reachable Dangerous Capabilitydist/index.cjs

HighChild Processdist/chunk-RNOYLQCV.js

HighShell

HighRemote Agent Bridgedist/chunk-RNOYLQCV.js

MediumDynamic Requiredist/chunk-RNOYLQCV.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

91%Warn

Verdict confidence

IntentDangerous Capability

TypeAI-agent capability abuse

False-positive riskLow

Review stagesource_first_review

Firewall policyWarn-only AI-agent capability risk

Package metadata

npm

AuthorAgentsKit Contributors

Maintainersemersonbraun

Version0.13.14

PublishedJul 11, 2026

LicenseMIT

Dependencies17

Integrityverified

Package size484 KB

Files17

Keywordsagentskitaiagentsllmchattypescriptclicommand-line

LinksRepository Homepage Issues

Runtime surface

package.json

Entrypointsmain → ./dist/index.cjsmodule → ./dist/index.jstypes → ./dist/index.d.tsexports mapbin → agentskit

RuntimeNo engine / OS / CPU constraints

Artifact1.96 MB · 17 files1 signature(s)

Install lifecycleNo install hooks · other: build, dev, lint, test +1

Behavioral surface

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellHighEntropyStringsUrlStringsManifest: clean

Source & flagged code

5 flagged

dist/chunk-RNOYLQCV.jsView file

Lines 1-58javascript

1#!/usr/bin/env node

2import { readdir, stat, mkdir, writeFile, glob, readFile } from 'fs/promises';

3import { homedir } from 'os';

4import path, { join, resolve, isAbsolute, basename, dirname, sep } from 'path';

5import { kimi, grok, deepseek, ollama, gemini, anthropic, openai } from '@agentskit/adapters';

6import { randomBytes, createHash } from 'crypto';

7import { writeFileSync, existsSync, readdirSync, statSync, readFileSync, mkdirSync, rmSync } from 'fs';

8import { spawn } from 'child_process';

9import React2, { useMemo, useState, useEffect, useRef } from 'react';

High

Child Process

Package source references child process execution.

dist/chunk-RNOYLQCV.jsView on unpkg · L7

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist/chunk-RNOYLQCV.jsView on unpkg · L7

10import { Box, Text, render } from 'ink';

11import { useChat, StatusHeader, ChatContainer, Message, ToolCallView, ToolConfirmation, ThinkingIndicator, InputBar } from '@agentskit/ink';

12import { shell, filesystem, fetchUrl, webSearch } from '@agentskit/tools';

13import { summarizer, critic, planner, coder, researcher, composeSkills } from '@agentskit/skills';

14import { fileVectorMemory, fileChatMemory, sqliteChatMemory } from '@agentskit/memory';

15import { getIntegration, integrationToolsFromEnv } from '@agentskit/integrations';

16import { jsxs, jsx } from 'react/jsx-runtime';

17import { pathToFileURL } from 'url';

18import { createRuntime, validateFlow, flowToMermaid, compileFlow, createFileStepLog } from '@agentskit/runtime';

19import chokidar from 'chokidar';

20import kleur3 from 'kleur';

21import { createRAG } from '@agentskit/rag';

22import { Command } from 'commander';

23import { input, select, checkbox, confirm } from '@inquirer/prompts';

24import { validateAgentSchema } from '@agentskit/core/agent-schema';

25import { parse } from 'yaml';

26import { validatePIITaxonomy } from '@agentskit/core/security';

27import { ConfigError, ErrorCodes } from '@agentskit/core';

29async function loadJsonConfig(path5) {

30 try {

31 const raw = await readFile(path5, "utf8");

32 return JSON.parse(raw);

33 } catch {

34 return void 0;

35 }

36}

37async function loadTsConfig(path5) {

38 try {

39 const mod = await import(path5);

40 return mod.default ?? mod;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/chunk-RNOYLQCV.jsView on unpkg · L38

41 } catch {

42 return void 0;

43 }

44}

45async function loadPackageJsonConfig(dir) {

46 try {

47 const raw = await readFile(join(dir, "package.json"), "utf8");

48 const pkg = JSON.parse(raw);

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/chunk-RNOYLQCV.jsView on unpkg · L7

49 if (pkg.agentskit && typeof pkg.agentskit === "object") {

50 return pkg.agentskit;

51 }

52 return void 0;

53 } catch {

54 return void 0;

55 }

56}

57function mergeConfigs(base, override) {

58 if (!base && !override) return void 0;

dist/index.cjsView file

Lines 1-37javascript

1#!/usr/bin/env node

2'use strict';

4var commander = require('commander');

5var React2 = require('react');

6var ink$1 = require('ink');

7var promises