registry / @aspectlylabs/mikka / 0.0.348
@aspectlylabs/mikka@0.0.348
Local Mikka daemon: runs agents through the user's own CLIs
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe flagged credential flow is a provider proxy used for an assigned agent run. Its destination comes from the provider credential, is restricted to HTTPS, and redirects are rejected; the reviewed source showed no unrelated credential exfiltration or malicious automatic action.
Static reason
One or more suspicious static signals were detected.
Trigger
A model credential is used when an agent run starts.
Impact
No unrelated credential exposure or harmful action was identified.
Mechanism
The broker sends requests to the configured HTTPS provider origin, or to Anthropic/OpenAI defaults, and disallows redirects.
AI rationale
The flagged credential flow is a provider proxy used for an assigned agent run. Its destination comes from the provider credential, is restricted to HTTPS, and redirects are rejected; the reviewed source showed no unrelated credential exfiltration or malicious automatic action.
Network endpoints2
api.anthropic.comapi.openai.com/v1
Decision evidence
public snapshotAI called this Clean at 90.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- Provider URLs must use HTTPS and cannot include embedded credentials, query strings, or fragments.
- The API-key broker uses the credential’s configured origin, or Anthropic/OpenAI defaults, and rejects redirects.
- The broker flow starts as part of an agent run that has an assigned model credential.
- The manifest describes a local daemon for running agents through the user’s own CLIs and declares no lifecycle scripts.
- Hosted child processes reject unexpected credential-bearing environment variables.
Evidence against
- The package runs agents and uses network requests and subprocesses as part of its stated purpose.
- The flagged credential and command paths have ordinary run, provider, or daemon-management contexts; no unrelated credential collection or destination was identified.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStrings
Source & flagged code
6 flaggedgithub-credentials.mjsView file
7import { randomUUID } from 'node:crypto'
L8: import { spawn } from 'node:child_process'
L9: import { pathToFileURL } from 'node:url'
High
Child Process
Package source references child process execution.
github-credentials.mjsView on unpkg · L7mikka.jsView file
4612ai: "7.0.142",
L4613: execa: "10.1.1",
L4614: pino: "10.4.0",
High
6401assertSafeId("run id", runId);
L6402: const common = resolve4(await worktreeGitDir(repoPath, worktree), "..", "..");
L6403: if (basename(common) !== ".git") throw new Error(`${repoPath} is not a standard clone`);
...
L6412: }
L6413: async function pinnedGit(repoPath, worktree, env = process.env) {
L6414: const gitDir = await worktreeGitDir(repoPath, worktree);
L6415: const workTree = realpathSync4(worktree);
L6416: return (args, extra, options) => execa3("git", [...SAFE_GIT, ...args], {
L6417: cwd: workTree,
Findings
5 High2 Medium5 Low
HighChild Processgithub-credentials.mjs
HighShellmikka.js
HighSame File Env Network Executionmikka.js
HighCredential Redirect Persistencemain.js
HighCommand Output Exfiltrationagents/native-container.mjs
MediumNetwork
MediumEnvironment Vars
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowCopyleft License
LowAi Review Evidencemain.js
Affected versions and remediation
This report applies to @aspectlylabs/mikka@0.0.348.
See all versions of @aspectlylabs/mikka for other recorded verdicts.
- Review the evidence and your use of @aspectlylabs/mikka@0.0.348 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.