registry / @agentskit/cli / 0.13.12

@agentskit/cli@0.13.12

CLI for AgentsKit chat and project scaffolding.

AI Security Review

scanned 4h ago · by lpm-firewall-ai

No confirmed malicious automatic attack surface was established. The sensitive capabilities are registered as explicit CLI features and require user invocation or user-provided configuration.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Explicit `agentskit` commands such as `run`, `chat`, `add`, `dev`, or `tunnel`, plus optional user configuration.

Impact

No install-time or import-time credential theft, persistence, or unconsented control-surface mutation found.

Mechanism

User-invoked agent tooling, project scaffolding, registry fetching, tunneling, and configured plugin/MCP execution.

Rationale

The scanner findings map to the package's advertised CLI and agent features, not an automatic malicious chain. Sensitive subprocess, network, and file operations are reached only through explicit commands or user-controlled configuration.

Evidence

package.jsondist/bin.jsdist/chunk-RNOYLQCV.jsdist/index.cjs

Decision evidence

public snapshot

AI called this Clean at 91.0% confidence as Benign with low false-positive risk.

Evidence for block

`dist/chunk-RNOYLQCV.js` can spawn configured MCP servers and user-configured shell hooks.
`dist/chunk-RNOYLQCV.js` supports explicit agent tools including shell and filesystem capabilities.
`dist/chunk-RNOYLQCV.js` fetches registry content only through the user-invoked `add` command.

Evidence against

`package.json` has no preinstall, install, postinstall, or other lifecycle hook.
`dist/bin.js` only constructs and parses the CLI; importing it does not run agent commands.
Provider keys are selected from documented provider options/env vars for explicit chat/run actions.
Registry authorization is limited to a configured matching registry base; no arbitrary environment harvesting was found.
No automatic exfiltration, stealth persistence, destructive action, or foreign AI-agent configuration mutation was found.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 5 file(s), 575 KB of source, external domains: api.anthropic.com, api.openai.com, generativelanguage.googleapis.com, github.com, nodejs.org, ollama.com, openrouter.ai, raw.githubusercontent.com, registry.agentskit.io, www.agentskit.io

Source & flagged code

5 flagged

dist/chunk-RNOYLQCV.jsView file

Lines 1-58javascript

1#!/usr/bin/env node

2import { readdir, stat, mkdir, writeFile, glob, readFile } from 'fs/promises';

3import { homedir } from 'os';

4import path, { join, resolve, isAbsolute, basename, dirname, sep } from 'path';

5import { kimi, grok, deepseek, ollama, gemini, anthropic, openai } from '@agentskit/adapters';

6import { randomBytes, createHash } from 'crypto';

7import { writeFileSync, existsSync, readdirSync, statSync, readFileSync, mkdirSync, rmSync } from 'fs';

8import { spawn } from 'child_process';

9import React2, { useMemo, useState, useEffect, useRef } from 'react';

High

Child Process

Package source references child process execution.

dist/chunk-RNOYLQCV.jsView on unpkg · L7

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist/chunk-RNOYLQCV.jsView on unpkg · L7

10import { Box, Text, render } from 'ink';

11import { useChat, StatusHeader, ChatContainer, Message, ToolCallView, ToolConfirmation, ThinkingIndicator, InputBar } from '@agentskit/ink';

12import { shell, filesystem, fetchUrl, webSearch } from '@agentskit/tools';

13import { summarizer, critic, planner, coder, researcher, composeSkills } from '@agentskit/skills';

14import { fileVectorMemory, fileChatMemory, sqliteChatMemory } from '@agentskit/memory';

15import { getIntegration, integrationToolsFromEnv } from '@agentskit/integrations';

16import { jsxs, jsx } from 'react/jsx-runtime';

17import { pathToFileURL } from 'url';

18import { createRuntime, validateFlow, flowToMermaid, compileFlow, createFileStepLog } from '@agentskit/runtime';

19import chokidar from 'chokidar';

20import kleur3 from 'kleur';

21import { createRAG } from '@agentskit/rag';

22import { Command } from 'commander';

23import { input, select, checkbox, confirm } from '@inquirer/prompts';

24import { validateAgentSchema } from '@agentskit/core/agent-schema';

25import { parse } from 'yaml';

26import { validatePIITaxonomy } from '@agentskit/core/security';

27import { ConfigError, ErrorCodes } from '@agentskit/core';

29async function loadJsonConfig(path5) {

30 try {

31 const raw = await readFile(path5, "utf8");

32 return JSON.parse(raw);

33 } catch {

34 return void 0;

35 }

36}

37async function loadTsConfig(path5) {

38 try {

39 const mod = await import(path5);

40 return mod.default ?? mod;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/chunk-RNOYLQCV.jsView on unpkg · L38

41 } catch {

42 return void 0;

43 }

44}

45async function loadPackageJsonConfig(dir) {

46 try {

47 const raw = await readFile(join(dir, "package.json"), "utf8");

48 const pkg = JSON.parse(raw);

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/chunk-RNOYLQCV.jsView on unpkg · L7

49 if (pkg.agentskit && typeof pkg.agentskit === "object") {

50 return pkg.agentskit;

51 }

52 return void 0;

53 } catch {

54 return void 0;

55 }

56}

57function mergeConfigs(base, override) {

58 if (!base && !override) return void 0;

dist/index.cjsView file

Lines 1-37javascript

1#!/usr/bin/env node

2'use strict';

4var commander = require('commander');

5var React2 = require('react');

6var ink$1 = require('ink');

7var promises

Source & flagged code

5 flagged · loading source

dist/chunk-RNOYLQCV.jsView file

7import { writeFileSync, existsSync, readdirSync, statSync, readFileSync, mkdirSync, rmSync } from 'fs'; L8: import { spawn } from 'child_process'; L9: import React2, { useMemo, useState, useEffect, useRef } from 'react'; ... L31: const raw = await readFile(path5, "utf8"); L32: return JSON.parse(raw); L33: } catch { ... L46: try { L47: const raw = await readFile(join(dir, "package.json"), "utf8"); L48: const pkg = JSON.parse(raw); ... L78: if (home === null) return void 0; L79: const globalDir = join(home ?? homedir(), ".agentskit"); L80: const tsConfig = await loadTsConfig(join(globalDir, "config.ts"));

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/chunk-RNOYLQCV.jsView on unpkg · L7

High

Child Process

Package source references child process execution.

dist/chunk-RNOYLQCV.jsView on unpkg · L7

7import { writeFileSync, existsSync, readdirSync, statSync, readFileSync, mkdirSync, rmSync } from 'fs'; L8: import { spawn } from 'child_process'; L9: import React2, { useMemo, useState, useEffect, useRef } from 'react'; ... L112: defaultModel: "llama3.1", L113: factory: (c) => ollama({ model: c.model, baseUrl: c.baseUrl }) L114: }, ... L226: try { L227: return JSON.parse(readFileSync(path5, "utf8")); L228: } catch {

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist/chunk-RNOYLQCV.jsView on unpkg · L7

38try { L39: const mod = await import(path5); L40: return mod.default ?? mod;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/chunk-RNOYLQCV.jsView on unpkg · L38

dist/index.cjsView file

17Trigger-reachable chain: manifest.main -> dist/index.cjs L17: var integrations = require('@agentskit/integrations'); L18: var child_process = require('child_process'); L19: var jsxRuntime = require('react/jsx-runtime'); ... L40: const raw = await promises.readFile(path5, "utf8"); L41: return JSON.parse(raw); L42: } catch { ... L55: try { L56: const raw = await promises.readFile(path.join(dir, "package.json"), "utf8"); L57: const pkg = JSON.parse(raw); ... L87: if (home === null) return void 0; L88: const globalDir = path.join(home ?? os.homedir(), ".agentskit"); L89: const tsConfig = await loadTsConfig(path.join(globalDir, "config.ts"));

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.cjsView on unpkg · L17

Findings

2 Critical3 High4 Medium4 Low

CriticalCredential Exfiltrationdist/chunk-RNOYLQCV.js

CriticalTrigger Reachable Dangerous Capabilitydist/index.cjs

HighChild Processdist/chunk-RNOYLQCV.js

HighShell

HighRemote Agent Bridgedist/chunk-RNOYLQCV.js

MediumDynamic Requiredist/chunk-RNOYLQCV.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

91%Pass

Verdict confidence

IntentBenign

False-positive riskLow

Review stagesource_first_review

Firewall policyNo policy match

Package metadata

npm

AuthorAgentsKit Contributors

Maintainersemersonbraun

Version0.13.14

PublishedJul 11, 2026

LicenseMIT

Dependencies17

Integrityverified

Package size484 KB

Files17

Keywordsagentskitaiagentsllmchattypescriptclicommand-line

LinksRepository Homepage Issues

Runtime surface

package.json

Entrypointsmain → ./dist/index.cjsmodule → ./dist/index.jstypes → ./dist/index.d.tsexports mapbin → agentskit

RuntimeNo engine / OS / CPU constraints

Artifact1.96 MB · 17 files1 signature(s)

Install lifecycleNo install hooks · other: build, dev, lint, test +1

Behavioral surface

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellHighEntropyStringsUrlStringsManifest: clean

Source & flagged code

5 flagged

dist/chunk-RNOYLQCV.jsView file

Lines 1-58javascript

1#!/usr/bin/env node

2import { readdir, stat, mkdir, writeFile, glob, readFile } from 'fs/promises';

3import { homedir } from 'os';

4import path, { join, resolve, isAbsolute, basename, dirname, sep } from 'path';

5import { kimi, grok, deepseek, ollama, gemini, anthropic, openai } from '@agentskit/adapters';

6import { randomBytes, createHash } from 'crypto';

7import { writeFileSync, existsSync, readdirSync, statSync, readFileSync, mkdirSync, rmSync } from 'fs';

8import { spawn } from 'child_process';

9import React2, { useMemo, useState, useEffect, useRef } from 'react';

High

Child Process

Package source references child process execution.

dist/chunk-RNOYLQCV.jsView on unpkg · L7

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist/chunk-RNOYLQCV.jsView on unpkg · L7

10import { Box, Text, render } from 'ink';

11import { useChat, StatusHeader, ChatContainer, Message, ToolCallView, ToolConfirmation, ThinkingIndicator, InputBar } from '@agentskit/ink';

12import { shell, filesystem, fetchUrl, webSearch } from '@agentskit/tools';

13import { summarizer, critic, planner, coder, researcher, composeSkills } from '@agentskit/skills';

14import { fileVectorMemory, fileChatMemory, sqliteChatMemory } from '@agentskit/memory';

15import { getIntegration, integrationToolsFromEnv } from '@agentskit/integrations';

16import { jsxs, jsx } from 'react/jsx-runtime';

17import { pathToFileURL } from 'url';

18import { createRuntime, validateFlow, flowToMermaid, compileFlow, createFileStepLog } from '@agentskit/runtime';

19import chokidar from 'chokidar';

20import kleur3 from 'kleur';

21import { createRAG } from '@agentskit/rag';

22import { Command } from 'commander';

23import { input, select, checkbox, confirm } from '@inquirer/prompts';

24import { validateAgentSchema } from '@agentskit/core/agent-schema';

25import { parse } from 'yaml';

26import { validatePIITaxonomy } from '@agentskit/core/security';

27import { ConfigError, ErrorCodes } from '@agentskit/core';

29async function loadJsonConfig(path5) {

30 try {

31 const raw = await readFile(path5, "utf8");

32 return JSON.parse(raw);

33 } catch {

34 return void 0;

35 }

36}

37async function loadTsConfig(path5) {

38 try {

39 const mod = await import(path5);

40 return mod.default ?? mod;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/chunk-RNOYLQCV.jsView on unpkg · L38

41 } catch {

42 return void 0;

43 }

44}

45async function loadPackageJsonConfig(dir) {

46 try {

47 const raw = await readFile(join(dir, "package.json"), "utf8");

48 const pkg = JSON.parse(raw);

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/chunk-RNOYLQCV.jsView on unpkg · L7

49 if (pkg.agentskit && typeof pkg.agentskit === "object") {

50 return pkg.agentskit;

51 }

52 return void 0;

53 } catch {

54 return void 0;

55 }

56}

57function mergeConfigs(base, override) {

58 if (!base && !override) return void 0;

dist/index.cjsView file

Lines 1-37javascript

1#!/usr/bin/env node

2'use strict';

4var commander = require('commander');

5var React2 = require('react');

6var ink$1 = require('ink');

7var promises