@agentvox/host@0.1.37
AgentVox host daemon — runs on machines you want to control hands-free via the AgentVox voice app.
AI Security Review
scanned 18d ago · by lpm-firewall-aiThe agent-integration location is reachable through a remote activity request and returns recent local conversation text over the configured authenticated proxy. This is a sensitive remote-control capability; the inspected source does not establish an attack or an unrelated credential recipient.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
The host daemon runs and receives an agent.activity request over its authenticated proxy connection.
Impact
A requester able to use the host’s proxy connection can receive recent local conversation text. The source does not show a hidden or default credential transfer to an unrelated recipient.
Mechanism
The CLI locates Claude session logs beneath the user’s home directory, parses recent user and assistant text, and sends the activity result to the requester. The websocket uses the configured proxy and saved bearer token.
AI rationale
The agent-integration location is reachable through a remote activity request and returns recent local conversation text over the configured authenticated proxy. This is a sensitive remote-control capability; the inspected source does not establish an attack or an unrelated credential recipient.
Evidence
dist/cli.jspackage.jsondist/vox.js
Decision evidence
public snapshotAI called this Suspicious at 83.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- package.json points the host and Vox commands to the reviewed CLI entrypoints; postinstall only runs the node-pty helper permission fix.
- The CLI parser reads local Claude project session logs, and an incoming agent.activity request invokes it and returns results to the requester.
- The CLI connects to its configured proxy using the saved bearer token; Vox uses that configured proxy and token for host-roster requests.
Evidence against
- When the daemon is running, an authenticated proxy connection can request recent local agent conversation text; this exposes sensitive data through the product’s remote agent-activity feature.
- The inspected source does not establish that the configured proxy is restricted to an operator-controlled destination.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
10 flaggedpackage.jsonView file
•scripts.postinstall = node ./scripts/fix-pty-helper.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgdist/vox.jsView file
13import { join } from "node:path";
L14: import { spawn, spawnSync } from "node:child_process";
L15: var REGISTRY = "https://registry.npmjs.org";
L16: var CHECK_INTERVAL_MS = 6 * 60 * 60 * 1e3;
...
L22: return null;
L23: const j2 = await r.json();
L24: return typeof j2.version === "string" ? j2.version : null;
...
L45: var defaultReExec = () => {
L46: const label = process.env.XPC_SERVICE_NAME;
L47: if (process.platform === "darwin" && label && /^[\w.-]+$/.test(label) && typeof process.getuid === "function") {
L48: try {
L49: spawn("/bin/sh", ["-c", `sleep 5; /bin/launchctl kickstart gui/${process.getuid()}/${label}`], {
Critical
Remote Asset Decode Execute
Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.
dist/vox.jsView on unpkg · L13Findings
3 Critical6 High5 Medium5 Low
CriticalRemote Asset Decode Executedist/vox.js
CriticalTrigger Reachable Dangerous Capabilitydist/vox.js
CriticalPrevious Version Dangerous Deltadist/cli.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/vox.js
HighHost Fingerprint Exfiltrationdist/vox.js
HighCredential Redirect Persistencedist/cli.js
HighSandbox Evasion Gated Capabilitydist/vox.js
HighRuntime Package Installdist/vox.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperscripts/install-systemd.sh
Medium
Affected versions and remediation
This report applies to @agentvox/host@0.1.37.
See all versions of @agentvox/host for other recorded verdicts.
- Review the evidence and your use of @agentvox/host@0.1.37 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.