registry / @aspectlylabs/mikka / 0.0.346
@aspectlylabs/mikka@0.0.346
Local Mikka daemon: runs agents through the user's own CLIs
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe flagged execution and credential flows serve the daemon's stated function. Model credentials are validated and sent through a restricted broker to the selected provider, while GitHub credentials are limited to the user's GitHub operations.
Static reason
One or more suspicious static signals were detected.
Trigger
A user starts the daemon or an agent run that uses a model credential or GitHub integration.
Impact
No unrelated credential collection, exfiltration, or harmful automatic action was identified.
Mechanism
The daemon routes model requests through a broker to the selected provider's HTTPS API and uses run-scoped GitHub credentials for github.com repositories.
AI rationale
The flagged execution and credential flows serve the daemon's stated function. Model credentials are validated and sent through a restricted broker to the selected provider, while GitHub credentials are limited to the user's GitHub operations.
Network endpoints4
api.anthropic.com/v1/messagesapi.anthropic.com/v1/messages/count_tokensapi.openai.com/v1/responsesapi.openai.com/v1/responses/compact
Decision evidence
public snapshotAI called this Clean at 93.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest describes a local daemon that runs agents through the user's CLIs and exposes a CLI plus library entry points.
- Custom model provider credentials require an HTTPS base URL and a matching Anthropic or OpenAI protocol.
- The API key broker accepts only the model API routes for the selected provider and places the key in that provider request's authorization header.
- GitHub credentials are scoped to HTTPS repositories on github.com and are fetched using the run token from a configured endpoint.
Evidence against
- The package uses child processes and network requests, which fit its stated purpose of running agent CLIs and routing model requests.
- Environment filtering excludes common provider credentials, cloud credentials, and tokens from the general child environment.
- The broker's outbound destinations are the selected provider base URL or the provider's standard API URL; no unrelated collector was identified.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystem
Source & flagged code
6 flaggedgithub-credentials.mjsView file
7import { randomUUID } from 'node:crypto'
L8: import { spawn } from 'node:child_process'
L9: import { pathToFileURL } from 'node:url'
High
Child Process
Package source references child process execution.
github-credentials.mjsView on unpkg · L7mikka.jsView file
4601ai: "7.0.142",
L4602: execa: "10.1.1",
L4603: pino: "10.4.0",
High
6385assertSafeId("run id", runId);
L6386: const common = resolve4(await worktreeGitDir(repoPath, worktree), "..", "..");
L6387: if (basename(common) !== ".git") throw new Error(`${repoPath} is not a standard clone`);
...
L6396: }
L6397: async function pinnedGit(repoPath, worktree, env = process.env) {
L6398: const gitDir = await worktreeGitDir(repoPath, worktree);
L6399: const workTree = realpathSync4(worktree);
L6400: return (args, extra, options) => execa3("git", [...SAFE_GIT, ...args], {
L6401: cwd: workTree,
Findings
5 High2 Medium5 Low
HighChild Processgithub-credentials.mjs
HighShellmikka.js
HighSame File Env Network Executionmikka.js
HighCredential Redirect Persistencemain.js
HighCommand Output Exfiltrationagents/native-container.mjs
MediumNetwork
MediumEnvironment Vars
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowCopyleft License
LowAi Review Evidencepackage.json
Affected versions and remediation
This report applies to @aspectlylabs/mikka@0.0.346.
See all versions of @aspectlylabs/mikka for other recorded verdicts.
- Review the evidence and your use of @aspectlylabs/mikka@0.0.346 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.