registry / @agentvox/host / 0.1.23
@agentvox/host@0.1.23
AgentVox host daemon — runs on machines you want to control hands-free via the AgentVox voice app.
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe inspected agent integration is an explicit paired host-control capability, not an install-time mutation or covert exfiltration chain. No concrete malicious behavior was established.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A user runs a command-line daemon and completes pairing; agent activity is returned only when the paired protocol requests it.
Impact
The paired user can receive agent-session activity, but the inspected code does not show covert collection, unrelated credential export, or unauthorized agent configuration mutation.
Mechanism
The host reads a selected Claude project-session directory and serializes requested activity results to the configured paired client. The Vox daemon also has an opt-out update checker.
AI rationale
The inspected agent integration is an explicit paired host-control capability, not an install-time mutation or covert exfiltration chain. No concrete malicious behavior was established.
Network endpoints2
proxy.agentvox.botregistry.npmjs.org
Decision evidence
public snapshotAI called this Clean at 84.0% confidence as Benign with medium false-positive risk.
Evidence for AI clean decision
- The manifest exposes command-line binaries; its only install hook invokes a local node-pty helper fix.
- Host pairing requires a QR-based pairing request before saving the proxy account, device, and token configuration.
- The agent-activity handler reads Claude project-session history for a selected running agent and returns the result through the paired protocol.
- The Vox daemon's runtime updater can be disabled with an environment setting.
Evidence against
- The daemon can return recent Claude session content to its paired remote client.
- The runtime updater can globally install a newer AgentVox package release.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkWebSocket
HighEntropyStringsUrlStrings
WildcardDependency
Source & flagged code
7 flaggedpackage.jsonView file
•scripts.postinstall = node ./scripts/fix-pty-helper.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgdist/vox.jsView file
13import { join } from "path";
L14: import { spawnSync } from "child_process";
L15: var REGISTRY = "https://registry.npmjs.org";
L16: var CHECK_INTERVAL_MS = 6 * 60 * 60 * 1e3;
...
L22: return null;
L23: const j = await r.json();
L24: return typeof j.version === "string" ? j.version : null;
...
L49: const fetchLatest = deps.fetchLatest ?? defaultFetchLatest;
L50: const pinned = process.env.AGENTVOX_VERSION;
L51: const latest = pinned ?? await fetchLatest(deps.pkg);
...
L112: var acquireInstanceLock = (name, log2) => {
L113: const dir = join(homedir(), ".agentvox");
Critical
Remote Asset Decode Execute
Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.
dist/vox.jsView on unpkg · L13•Trigger-reachable chain: manifest.bin -> dist/vox.js
Reachable file contains a blocking source-risk pattern.
Findings
2 Critical4 High5 Medium5 Low
CriticalRemote Asset Decode Executedist/vox.js
CriticalTrigger Reachable Dangerous Capabilitydist/vox.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/vox.js
HighHost Fingerprint Exfiltrationdist/vox.js
HighRuntime Package Installdist/vox.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperscripts/install-systemd.sh
MediumStructural Risk Force Deep Review
MediumWildcard Dependency
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
Affected versions and remediation
This report applies to @agentvox/host@0.1.23.
See all versions of @agentvox/host for other recorded verdicts.
- Review the evidence and your use of @agentvox/host@0.1.23 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.