registry / @aspectlylabs/mikka / 0.0.288
@aspectlylabs/mikka@0.0.288
Local Mikka daemon: runs agents through the user's own CLIs
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe flagged credential and network code implements the daemon's agent-provider transport: it uses official defaults or a validated provider URL and forwards requests through a local broker. The manifest declares no install lifecycle scripts, and the reviewed source does not show credential redirection or persistence.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Normal CLI, daemon, or agent-run activity; no install hook is declared.
Impact
No unauthorized credential collection, redirection, or persistence was identified.
Mechanism
Agent model requests pass through a local broker, which forwards them to the run credential's provider URL or the official Anthropic or OpenAI endpoint.
AI rationale
The flagged credential and network code implements the daemon's agent-provider transport: it uses official defaults or a validated provider URL and forwards requests through a local broker. The manifest declares no install lifecycle scripts, and the reviewed source does not show credential redirection or persistence.
Network endpoints3
api.anthropic.comapi.openai.comapp.aspectlylabs.com
Decision evidence
public snapshotAI called this Clean at 97.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest describes a local daemon that runs agents through the user's own CLIs and exposes a CLI entry point.
- Provider credentials require HTTPS and reject URLs containing embedded credentials, query strings, or fragments.
- The API-key broker defaults to official Anthropic and OpenAI endpoints and limits requests to specific API paths.
- The broker sends the key to the selected provider URL in an API request and rejects redirects.
- The hosted runner sends model traffic through a local task broker socket.
Evidence against
- The manifest has no lifecycle scripts that run during installation.
- The reviewed broker code contains no fixed unofficial API gateway; a provider URL comes from the run credential or the official endpoint defaults.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
6 flaggedgithub-credentials.mjsView file
4import { randomUUID } from 'node:crypto'
L5: import { spawn } from 'node:child_process'
L6: import { pathToFileURL } from 'node:url'
High
Child Process
Package source references child process execution.
github-credentials.mjsView on unpkg · L4mikka.jsView file
4562ai: "7.0.142",
L4563: execa: "10.1.1",
L4564: pino: "10.4.0",
High
6339assertSafeId("run id", runId);
L6340: const common = resolve4(await worktreeGitDir(repoPath, worktree), "..", "..");
L6341: if (basename(common) !== ".git") throw new Error(`${repoPath} is not a standard clone`);
...
L6350: }
L6351: async function pinnedGit(repoPath, worktree, env = process.env) {
L6352: const gitDir = await worktreeGitDir(repoPath, worktree);
L6353: const workTree = realpathSync4(worktree);
L6354: return (args, extra, options) => execa3("git", [...SAFE_GIT, ...args], {
L6355: cwd: workTree,
Findings
1 Critical5 High2 Medium4 Low
CriticalPrevious Version Dangerous Deltacomputer/driver.mjs
HighChild Processgithub-credentials.mjs
HighShellmikka.js
HighSame File Env Network Executionmikka.js
HighCredential Redirect Persistencemain.js
HighCommand Output Exfiltrationagents/native-container.mjs
MediumNetwork
MediumEnvironment Vars
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowCopyleft License
Affected versions and remediation
This report applies to @aspectlylabs/mikka@0.0.288.
See all versions of @aspectlylabs/mikka for other recorded verdicts.
- Review the evidence and your use of @aspectlylabs/mikka@0.0.288 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.