@agentvox/host@0.1.34
AgentVox host daemon — runs on machines you want to control hands-free via the AgentVox voice app.
AI Security Review
scanned 21d ago · by lpm-firewall-aiStatic inspection found a conditional credential exposure: an existing xAI key is sent to an operator-configurable base URL without destination validation. The default is the intended xAI endpoint, so this supports a warning rather than a malicious block.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
The host daemon starts with an inference key available and makes an inference request.
Impact
A user who configures an unrelated endpoint may expose the API key to that endpoint; no hidden default redirection was found.
Mechanism
The client selects XAI_BASE_URL when set and attaches the existing API key as a Bearer credential to requests at that base URL.
AI rationale
Static inspection found a conditional credential exposure: an existing xAI key is sent to an operator-configurable base URL without destination validation. The default is the intended xAI endpoint, so this supports a warning rather than a malicious block.
Evidence
dist/cli.js
Network endpoints1
api.x.ai/v1
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- dist/cli.js reads an existing XAI_API_KEY or ~/.agentvox/xai.key credential.
- dist/cli.js permits XAI_BASE_URL to override the default x.ai endpoint without a destination allowlist.
- dist/cli.js sends the stored API key as a Bearer credential to the configured base URL.
- dist/cli.js also reads Claude session-history paths as part of its session parsing feature.
- package.json postinstall only runs a helper that marks node-pty's spawn-helper executable.
Evidence against
- The API client defaults to https://api.x.ai/v1, the intended xAI service endpoint.
- The postinstall helper only changes permissions on a node-pty helper when needed; it does not install another package or modify agent configuration.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
9 flaggedpackage.jsonView file
•scripts.postinstall = node ./scripts/fix-pty-helper.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgdist/vox.jsView file
13import { join } from "node:path";
L14: import { spawnSync } from "node:child_process";
L15: var REGISTRY = "https://registry.npmjs.org";
L16: var CHECK_INTERVAL_MS = 6 * 60 * 60 * 1e3;
...
L22: return null;
L23: const j2 = await r.json();
L24: return typeof j2.version === "string" ? j2.version : null;
...
L49: const fetchLatest = deps.fetchLatest ?? defaultFetchLatest;
L50: const pinned = process.env.AGENTVOX_VERSION;
L51: const latest = pinned ?? await fetchLatest(deps.pkg);
...
L112: var acquireInstanceLock = (name, log2) => {
L113: const dir = join(homedir(), ".agentvox");
Critical
Remote Asset Decode Execute
Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.
dist/vox.jsView on unpkg · L13•Trigger-reachable chain: manifest.bin -> dist/vox.js
Reachable file contains a blocking source-risk pattern.
Findings
3 Critical5 High5 Medium5 Low
CriticalRemote Asset Decode Executedist/vox.js
CriticalTrigger Reachable Dangerous Capabilitydist/vox.js
CriticalPrevious Version Dangerous Deltadist/cli.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/vox.js
HighHost Fingerprint Exfiltrationdist/vox.js
HighCredential Redirect Persistencedist/cli.js
HighRuntime Package Installdist/vox.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperscripts/install-systemd.sh
MediumStructural Risk Force Deep Review
MediumWildcard Dependency
Affected versions and remediation
This report applies to @agentvox/host@0.1.34.
See all versions of @agentvox/host for other recorded verdicts.
- Review the evidence and your use of @agentvox/host@0.1.34 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.