registry / @agentvault/openai-bridge / 0.1.16
@agentvault/openai-bridge@0.1.16
AgentVault OpenAI Codex bridge for encrypted owner messages and rooms
AI Security Review
scanned 7h ago · by lpm-firewall-aiThe flagged command execution is constrained to a dedicated Codex child environment and read-only sandbox, and the CLI starts only when explicitly invoked. Its network destination is the package's advertised AgentVault service, with user-configurable origins restricted to HTTPS.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
The user explicitly runs the login or run command; importing the entry point alone does not start the CLI.
Impact
The intended result is encrypted owner messaging with Codex-generated replies; no unrelated collection or command-output exfiltration was identified in the reviewed paths.
Mechanism
The bridge launches a dedicated Codex CLI with a read-only sandbox and sends bridge traffic to the configured HTTPS AgentVault API origin, defaulting to api.agentvault.chat.
AI rationale
The flagged command execution is constrained to a dedicated Codex child environment and read-only sandbox, and the CLI starts only when explicitly invoked. Its network destination is the package's advertised AgentVault service, with user-configurable origins restricted to HTTPS.
Evidence
dist/index.jspackage.jsonREADME.md
Network endpoints1
api.agentvault.chat
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package describes itself as a bridge for encrypted AgentVault owner messages and rooms.
- The CLI runs only when the file is invoked as the executable; importing the entry point does not start the bridge.
- Codex invocations use read-only sandboxing and a dedicated working directory.
- Codex children receive a minimal environment with dedicated HOME, CODEX_HOME, and TMPDIR values.
- The documented login command explicitly starts official Codex device authentication in the agent's dedicated auth directory.
- The default API origin is https://api.agentvault.chat, and configured origins must use HTTPS.
Evidence against
- The manifest maps both the main entry and executable to the large bundled dist/index.js file.
- The bundle contains process execution and network requests, though the reviewed flow uses these for the advertised bridge feature.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
Source & flagged code
9 flaggeddist/index.jsView file
104761await init_bridge();
L104762: import { spawn as spawn2 } from "node:child_process";
L104763: import { realpathSync } from "node:fs";
...
L104773: checkBinary: checkVersion,
L104774: output: (text) => process.stdout.write(text + "\n"),
L104775: command: (binary, args2, options = {}) => new Promise((resolve4, reject) => {
L104776: const child = spawn2(binary, args2, { env: options.env ?? { PATH: "/usr/bin:/bin", HOME: process.env.HOME, XDG_RUNTIME_DIR: process.env.XDG_RUNTIME_DIR, DBUS_SESSION_BUS_ADDRESS: p...
Critical
Command Output Exfiltration
Source executes local commands and sends command output to an external endpoint.
dist/index.jsView on unpkg · L104761104761Trigger-reachable chain: manifest.main -> dist/index.js
L104761: await init_bridge();
L104762: import { spawn as spawn2 } from "node:child_process";
L104763: import { realpathSync } from "node:fs";
...
L104773: checkBinary: checkVersion,
L104774: output: (text) => process.stdout.write(text + "\n"),
L104775: command: (binary, args2, options = {}) => new Promise((resolve4, reject) => {
L104776: const child = spawn2(binary, args2, { env: options.env ?? { PATH: "/usr/bin:/bin", HOME: process.env.HOME, XDG_RUNTIME_DIR: process.env.XDG_RUNTIME_DIR, DBUS_SESSION_BUS_ADDRESS: p...
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/index.jsView on unpkg · L104761Findings
2 Critical6 High5 Medium5 Low
CriticalCommand Output Exfiltrationdist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
HighChild Processdist/index.js
HighShell
HighSame File Env Network Executiondist/index.js
HighCredential Redirect Persistencedist/index.js
HighTrigger Reachable Command Output Exfiltrationdist/index.js
HighSemantic Analysis Limiteddist/index.js
MediumNetwork
MediumEnvironment Vars
MediumOversized Source Filedist/index.js
MediumOversized Cli Entrypointdist/index.js
MediumStructural Risk Force Deep Review
Affected versions and remediation
This report applies to @agentvault/openai-bridge@0.1.16.
See all versions of @agentvault/openai-bridge for other recorded verdicts.
- Review the evidence and your use of @agentvault/openai-bridge@0.1.16 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.