registry / @aspectlylabs/mikka / 0.0.415
@aspectlylabs/mikka@0.0.415
Local Mikka daemon: runs agents through the user's own CLIs
AI Security Review
scanned 1d ago · by lpm-firewall-aiThe flagged process execution is consistent with this local agent daemon’s purpose. The reviewed credential path forwards provider keys to the configured HTTPS API endpoint (or official provider defaults), with no evidence of a fixed unrelated gateway or install-time behavior.
Static reason
One or more suspicious static signals were detected.
Trigger
The user invokes the mikka CLI or starts a run that uses a configured model provider.
Impact
Expected agent execution and provider API traffic; no malicious collection or unrelated credential destination was found in the reviewed paths.
Mechanism
The CLI starts the daemon; the daemon runs agent processes and uses a local broker to forward permitted API requests to the configured provider endpoint.
AI rationale
The flagged process execution is consistent with this local agent daemon’s purpose. The reviewed credential path forwards provider keys to the configured HTTPS API endpoint (or official provider defaults), with no evidence of a fixed unrelated gateway or install-time behavior.
Network endpoints3
api.anthropic.comapi.openai.com/v1user-configured HTTPS provider base URL
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package exposes a daemon CLI and JavaScript entry points; the CLI invokes its command handler.
- Provider credentials are checked for validity, and provider URLs must use HTTPS without embedded credentials.
- The API-key broker forwards requests to the credential’s configured base URL, or the official Anthropic and OpenAI defaults, using provider-specific API paths.
- The run mailbox requires its assigned endpoint to match the configured server endpoint and pass HTTPS or loopback validation.
Evidence against
- The source uses child processes to run coding agents, consistent with the package’s stated purpose of running agents through the user’s CLIs.
- The flagged credential flow forwards user-supplied provider credentials to their configured model API endpoint; the reviewed source does not show an unrelated fixed gateway.
- The package manifest contains no lifecycle scripts.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
Source & flagged code
6 flaggedgithub-credentials.mjsView file
7import { randomUUID } from 'node:crypto'
L8: import { spawn } from 'node:child_process'
L9: import { pathToFileURL } from 'node:url'
High
Child Process
Package source references child process execution.
github-credentials.mjsView on unpkg · L7mikka.jsView file
4637ai: "7.0.142",
L4638: execa: "10.1.1",
L4639: pino: "10.4.0",
High
6566assertSafeId("run id", runId);
L6567: const common = resolve4(await worktreeGitDir(repoPath, worktree), "..", "..");
L6568: if (basename(common) !== ".git") throw new Error(`${repoPath} is not a standard clone`);
...
L6577: }
L6578: async function pinnedGit(repoPath, worktree, env = process.env) {
L6579: const gitDir = await worktreeGitDir(repoPath, worktree);
L6580: const workTree = realpathSync4(worktree);
L6581: return (args, extra, options) => execa3("git", [...SAFE_GIT, ...args], {
L6582: cwd: workTree,
Findings
5 High2 Medium5 Low
HighChild Processgithub-credentials.mjs
HighShellmikka.js
HighSame File Env Network Executionmikka.js
HighCredential Redirect Persistencemain.js
HighCommand Output Exfiltrationagents/native-container.mjs
MediumNetwork
MediumEnvironment Vars
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowCopyleft License
LowAi Review Evidencepackage.json
Affected versions and remediation
This report applies to @aspectlylabs/mikka@0.0.415.
See all versions of @aspectlylabs/mikka for other recorded verdicts.
- Review the evidence and your use of @aspectlylabs/mikka@0.0.415 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.