registry / @aspectlylabs/mikka / 0.0.320
@aspectlylabs/mikka@0.0.320
Local Mikka daemon: runs agents through the user's own CLIs
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe flagged process execution, credential handling, and network access fit this package's stated purpose of running agents through the user's CLIs. The reviewed flows are run-scoped and directed to the selected provider or trusted Mikka endpoint; no unrelated collection or install-time behavior was found.
Static reason
One or more suspicious static signals were detected.
Trigger
A run starts after run-tool approval and has a model credential or GitHub access assigned.
Impact
Expected agent functionality: model requests reach the configured provider, and GitHub operations use the run's delegated access.
Mechanism
A local broker forwards model requests to the selected provider; GitHub access uses a run token to obtain a run-scoped credential from a trusted endpoint.
AI rationale
The flagged process execution, credential handling, and network access fit this package's stated purpose of running agents through the user's CLIs. The reviewed flows are run-scoped and directed to the selected provider or trusted Mikka endpoint; no unrelated collection or install-time behavior was found.
Evidence
main.jsgithub-credentials.mjs
Network endpoints4
api.anthropic.comapi.openai.comMikka-configured model providerMikka trusted run endpoint
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest describes a local daemon that runs agents through the user's own CLIs and has no lifecycle scripts.
- The model API broker is created for an approved run and forwards credentials only to the configured provider over HTTPS; default destinations are api.anthropic.com and api.openai.com.
- GitHub credentials are obtained through a trusted Mikka run endpoint and used for GitHub repository operations.
Evidence against
- The flagged process execution and network access support the package's stated agent-running purpose.
- The model broker limits requests to provider API paths, rejects redirects, and removes its temporary key when closed.
- The GitHub credential exchange uses a run token and rejects untrusted endpoint hosts.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
6 flaggedgithub-credentials.mjsView file
7import { randomUUID } from 'node:crypto'
L8: import { spawn } from 'node:child_process'
L9: import { pathToFileURL } from 'node:url'
High
Child Process
Package source references child process execution.
github-credentials.mjsView on unpkg · L7mikka.jsView file
4570ai: "7.0.142",
L4571: execa: "10.1.1",
L4572: pino: "10.4.0",
High
6352assertSafeId("run id", runId);
L6353: const common = resolve4(await worktreeGitDir(repoPath, worktree), "..", "..");
L6354: if (basename(common) !== ".git") throw new Error(`${repoPath} is not a standard clone`);
...
L6363: }
L6364: async function pinnedGit(repoPath, worktree, env = process.env) {
L6365: const gitDir = await worktreeGitDir(repoPath, worktree);
L6366: const workTree = realpathSync4(worktree);
L6367: return (args, extra, options) => execa3("git", [...SAFE_GIT, ...args], {
L6368: cwd: workTree,
Findings
5 High2 Medium5 Low
HighChild Processgithub-credentials.mjs
HighShellmikka.js
HighSame File Env Network Executionmikka.js
HighCredential Redirect Persistencemain.js
HighCommand Output Exfiltrationagents/native-container.mjs
MediumNetwork
MediumEnvironment Vars
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowCopyleft License
LowSuspicious Lifecycle Evidencepackage.json
Affected versions and remediation
This report applies to @aspectlylabs/mikka@0.0.320.
See all versions of @aspectlylabs/mikka for other recorded verdicts.
- Review the evidence and your use of @aspectlylabs/mikka@0.0.320 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.