@agentvox/host@0.1.30

AgentVox host daemon — runs on machines you want to control hands-free via the AgentVox voice app.

AI Security Review

scanned 21d ago · by lpm-firewall-ai

Source inspection found a narrowly scoped postinstall permission fix and application network flows, including an XAI key sent to x.ai’s own API. The scanner’s remote-payload and exfiltration claims were not supported by the inspected source.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

Installation triggers the postinstall helper fix; credential and metadata flows run when the corresponding CLI features are used.

Impact

The inspected behavior does not establish credential theft, remote payload execution, or an unconsented change to an AI-agent control surface.

Mechanism

The helper adjusts permissions on node-pty spawn-helper files. The realtime API key is sent to x.ai, and host metadata is collected for the Vox daemon.

AI rationale

Evidence

scripts/fix-pty-helper.mjsdist/cli.jsdist/vox.js

Network endpoints1

api.x.ai/v1/realtime/client_secrets

Decision evidence

public snapshot

AI called this Clean at 91.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The package entrypoints are CLI commands, and its postinstall hook runs a helper fix script.
The helper fix script only checks bundled node-pty spawn-helper files and adds executable permission when missing.
The flagged Claude integration reads local session history as part of the host’s interaction feature.
The realtime pipeline obtains an XAI key from XAI_API_KEY or ~/.agentvox/xai.key and sends it to x.ai’s realtime API.
The Vox daemon gathers username, hostname, and working directory as host metadata for its application flow.

Evidence against

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsUrlStrings

Manifest

WildcardDependency

scanned 4 file(s), 241 KB of source, external domains: api.x.ai, proxy.agentvox.bot, registry.npmjs.org

Source & flagged code

9 flagged

package.jsonView file

•scripts.postinstall = node ./scripts/fix-pty-helper.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/vox.jsView file

13import { join } from "path"; L14: import { spawnSync } from "child_process"; L15: var REGISTRY = "https://registry.npmjs.org"; L16: var CHECK_INTERVAL_MS = 6 * 60 * 60 * 1e3; ... L22: return null; L23: const j = await r.json(); L24: return typeof j.version === "string" ? j.version : null; ... L49: const fetchLatest = deps.fetchLatest ?? defaultFetchLatest; L50: const pinned = process.env.AGENTVOX_VERSION; L51: const latest = pinned ?? await fetchLatest(deps.pkg); ... L112: var acquireInstanceLock = (name, log2) => { L113: const dir = join(homedir(), ".agentvox");

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

dist/vox.jsView on unpkg · L13

•Trigger-reachable chain: manifest.bin -> dist/vox.js Reachable file contains a blocking source-risk pattern.

Findings

3 Critical5 High5 Medium5 Low

CriticalRemote Asset Decode Executedist/vox.js

CriticalTrigger Reachable Dangerous Capabilitydist/vox.js

CriticalPrevious Version Dangerous Deltadist/cli.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/vox.js

HighHost Fingerprint Exfiltrationdist/vox.js

HighCredential Redirect Persistencedist/cli.js

HighRuntime Package Installdist/vox.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperscripts/install-systemd.sh

MediumStructural Risk Force Deep Review

MediumWildcard Dependency

Affected versions and remediation

This report applies to @agentvox/host@0.1.30.

See all versions of @agentvox/host for other recorded verdicts.

Review the evidence and your use of @agentvox/host@0.1.30 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-08 15:20:46.582Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.