registry / @agentvault/openai-bridge / 0.1.2
@agentvault/openai-bridge@0.1.2
AgentVault OpenAI Codex bridge for encrypted owner messages and rooms
AI Security Review
scanned 22d ago · by lpm-firewall-aiSource inspection shows the scanner's subprocess and network findings correspond to the bridge's local Codex runner and AgentVault messaging flow. The manifest has no install hook, and the inspected credential setup and endpoint validation do not establish credential redirection or command-output exfiltration.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
The CLI runs when invoked; login, service installation, or bridge operation require explicit commands.
Impact
No attack impact was identified; the inspected subprocess and network behavior supports the bridge's stated function.
Mechanism
It runs Codex with dedicated state and a restricted environment, then sends replies to the conversation target that supplied the message.
AI rationale
Source inspection shows the scanner's subprocess and network findings correspond to the bridge's local Codex runner and AgentVault messaging flow. The manifest has no install hook, and the inspected credential setup and endpoint validation do not establish credential redirection or command-output exfiltration.
Evidence
package.jsondist/index.js
Network endpoints1
api.agentvault.chat
Decision evidence
public snapshotAI called this Clean at 98.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json points to dist/index.js and defines prepublishOnly as a build hook; it has no install lifecycle hook.
- Codex device login is an explicit CLI command, and the child process uses dedicated bridge directories and environment variables.
- The AgentVault API defaults to api.agentvault.chat, and the configured origin must use HTTPS without embedded credentials, query, or fragment.
- The runtime launches the local Codex CLI with a dedicated environment and disables shell and other tool features.
- The bridge sends AgentVault conversation prompts to Codex and delivers the response to the same direct-message or room target.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
9 flaggeddist/index.jsView file
102211await init_bridge();
L102212: import { spawn as spawn2 } from "node:child_process";
L102213: import { realpathSync } from "node:fs";
...
L102223: checkBinary: checkVersion,
L102224: output: (text) => process.stdout.write(text + "\n"),
L102225: command: (binary, args2, options = {}) => new Promise((resolve4, reject) => {
L102226: const child = spawn2(binary, args2, { env: options.env ?? { PATH: "/usr/bin:/bin", HOME: process.env.HOME, XDG_RUNTIME_DIR: process.env.XDG_RUNTIME_DIR, DBUS_SESSION_BUS_ADDRESS: p...
Critical
Command Output Exfiltration
Source executes local commands and sends command output to an external endpoint.
dist/index.jsView on unpkg · L102211102211Trigger-reachable chain: manifest.main -> dist/index.js
L102211: await init_bridge();
L102212: import { spawn as spawn2 } from "node:child_process";
L102213: import { realpathSync } from "node:fs";
...
L102223: checkBinary: checkVersion,
L102224: output: (text) => process.stdout.write(text + "\n"),
L102225: command: (binary, args2, options = {}) => new Promise((resolve4, reject) => {
L102226: const child = spawn2(binary, args2, { env: options.env ?? { PATH: "/usr/bin:/bin", HOME: process.env.HOME, XDG_RUNTIME_DIR: process.env.XDG_RUNTIME_DIR, DBUS_SESSION_BUS_ADDRESS: p...
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/index.jsView on unpkg · L102211Findings
2 Critical6 High5 Medium5 Low
CriticalCommand Output Exfiltrationdist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
HighChild Processdist/index.js
HighShell
HighSame File Env Network Executiondist/index.js
HighCredential Redirect Persistencedist/index.js
HighTrigger Reachable Command Output Exfiltrationdist/index.js
HighSemantic Analysis Limiteddist/index.js
MediumNetwork
MediumEnvironment Vars
MediumOversized Source Filedist/index.js
MediumOversized Cli Entrypointdist/index.js
MediumStructural Risk Force Deep Review
Affected versions and remediation
This report applies to @agentvault/openai-bridge@0.1.2.
See all versions of @agentvault/openai-bridge for other recorded verdicts.
- Review the evidence and your use of @agentvault/openai-bridge@0.1.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.