registry / @agentvault/openai-bridge / 0.1.5
@agentvault/openai-bridge@0.1.5
AgentVault OpenAI Codex bridge for encrypted owner messages and rooms
AI Security Review
scanned 13d ago · by lpm-firewall-aiSource inspection found no concrete malicious behavior. The scanner's command-output and credential-redirection indicators are not supported by the reviewed runtime paths, which show constrained Codex invocation and response parsing.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A user explicitly runs the bridge or installs its service; runtime turns begin on owner direct messages or addressed room messages.
Impact
No confirmed unauthorized command execution, credential transfer, or persistence beyond the user-requested service setup was established.
Mechanism
The bridge runs Codex in an isolated read-only workspace with shell and related capabilities disabled, then parses its response for delivery.
AI rationale
Source inspection found no concrete malicious behavior. The scanner's command-output and credential-redirection indicators are not supported by the reviewed runtime paths, which show constrained Codex invocation and response parsing.
Decision evidence
public snapshotAI called this Clean at 96.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json uses prepublishOnly only to run the build; the runtime entrypoint is dist/index.js.
- dist/index.js launches Codex in a read-only sandbox with shell and other powerful features disabled.
- The bridge accepts owner direct messages and addressed room messages, then sends them to the configured Codex driver for a reply.
- The child process output is parsed as Codex response events; the reviewed path does not forward command output to an external collector.
- The ws dependency source shows ordinary WebSocket exports and protocol header handling.
Evidence against
- Scanner labels report command-output exfiltration and credential redirection, but the inspected entrypoint shows isolated Codex invocation and response parsing, not those behaviors.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStrings
Source & flagged code
9 flaggeddist/index.jsView file
102497await init_bridge();
L102498: import { spawn as spawn2 } from "node:child_process";
L102499: import { realpathSync } from "node:fs";
...
L102509: checkBinary: checkVersion,
L102510: output: (text) => process.stdout.write(text + "\n"),
L102511: command: (binary, args2, options = {}) => new Promise((resolve4, reject) => {
L102512: const child = spawn2(binary, args2, { env: options.env ?? { PATH: "/usr/bin:/bin", HOME: process.env.HOME, XDG_RUNTIME_DIR: process.env.XDG_RUNTIME_DIR, DBUS_SESSION_BUS_ADDRESS: p...
Critical
Command Output Exfiltration
Source executes local commands and sends command output to an external endpoint.
dist/index.jsView on unpkg · L102497102497Trigger-reachable chain: manifest.main -> dist/index.js
L102497: await init_bridge();
L102498: import { spawn as spawn2 } from "node:child_process";
L102499: import { realpathSync } from "node:fs";
...
L102509: checkBinary: checkVersion,
L102510: output: (text) => process.stdout.write(text + "\n"),
L102511: command: (binary, args2, options = {}) => new Promise((resolve4, reject) => {
L102512: const child = spawn2(binary, args2, { env: options.env ?? { PATH: "/usr/bin:/bin", HOME: process.env.HOME, XDG_RUNTIME_DIR: process.env.XDG_RUNTIME_DIR, DBUS_SESSION_BUS_ADDRESS: p...
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/index.jsView on unpkg · L102497Findings
2 Critical6 High5 Medium5 Low
CriticalCommand Output Exfiltrationdist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
HighChild Processdist/index.js
HighShell
HighSame File Env Network Executiondist/index.js
HighCredential Redirect Persistencedist/index.js
HighTrigger Reachable Command Output Exfiltrationdist/index.js
HighSemantic Analysis Limiteddist/index.js
MediumNetwork
MediumEnvironment Vars
MediumOversized Source Filedist/index.js
MediumOversized Cli Entrypointdist/index.js
MediumStructural Risk Force Deep Review
Affected versions and remediation
This report applies to @agentvault/openai-bridge@0.1.5.
See all versions of @agentvault/openai-bridge for other recorded verdicts.
- Review the evidence and your use of @agentvault/openai-bridge@0.1.5 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.