registry / @autonoma-ai/planner / 0.1.14

@autonoma-ai/planner@0.1.14

Autonoma test planner — generate E2E test cases for any frontend codebase.

AI Security Review

scanned 8d ago · by lpm-firewall-ai

No confirmed malicious attack surface was found. The package is a user-invoked E2E test planner CLI with AI, analytics, local output files, and optional Autonoma artifact upload.

Static reason

One or more suspicious static signals were detected.

Trigger

User runs autonoma-planner CLI

Impact

Expected project inspection and generated test artifacts; no install-time execution or credential harvesting beyond documented configuration use.

Mechanism

AI-assisted codebase analysis with local artifact generation and optional upload

Rationale

Static inspection shows potentially sensitive primitives are aligned with the CLI's declared planner workflow and require explicit runtime use/configuration. There is no lifecycle execution, hidden exfiltration, persistence, destructive behavior, or unconsented AI-agent control-surface mutation.

Evidence

package.jsonREADME.mddist/index.js~/.autonoma/.device-id~/.autonoma/.env~/.autonoma/<projectSlug>/.project-context.json~/.autonoma/<projectSlug>/.pipeline-state.json~/.autonoma/<projectSlug>/AUTONOMA.md~/.autonoma/<projectSlug>/entity-audit.md~/.autonoma/<projectSlug>/scenarios.md~/.autonoma/<projectSlug>/recipe.json~/.autonoma/<projectSlug>/qa-tests/**

Network endpoints5

us.i.posthog.com/capture/agent.autonoma.appdocs.agent.autonoma.appopenrouter.ai/keysopenrouter.ai/settings/credits

Decision evidence

public snapshot

AI called this Clean at 88.0% confidence as Benign with low false-positive risk.

Evidence for block

dist/index.js sends opt-out analytics to https://us.i.posthog.com/capture/ and may include error messages/stacks.
dist/index.js can upload generated artifacts to AUTONOMA_API_URL/default https://agent.autonoma.app when token/id env vars are set.
dist/index.js exposes user-invoked AI tools for reading project files, writing output files, and limited shell commands.

Evidence against

package.json has no preinstall/install/postinstall/prepare lifecycle hooks; only a CLI bin points to dist/index.js.
OPENROUTER_API_KEY is read for declared LLM use and prompted/cached in ~/.autonoma/.env only during CLI execution.
The static secret-looking phc_ value is a public PostHog ingestion key, documented in code comments as client-safe.
Shell execution is constrained to a fixed command allowlist and validates against chaining/redirect/subshell patterns.
File writes are sandboxed to the CLI output directory except documented ~/.autonoma config/device-id storage.
README.md documents OpenRouter, Autonoma upload credentials, analytics opt-out, and local artifact behavior.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 1 file(s), 298 KB of source, external domains: docs.agent.autonoma.app, openrouter.ai, us.i.posthog.com

Source & flagged code

2 flagged

dist/index.jsView file

Lines 2357-2397javascript

2357- Dependents (independently_created: false) with owner chains

2358- Dual-creation models (both true AND non-empty created_by)

2359- Dependency graph summary (which models must exist before others)

2360

2361### 2. factory-scaffold.ts

2362

2363A TypeScript file with defineFactory() stubs for every model with independently_created: true.

2364

2365Format:

2366\`\`\`typescript

2367import { defineFactory } from '@autonoma-ai/sdk'

2368import { z } from 'zod'

2369

2370export const User = defineFactory({

2371 inputSchema: z.object({

2372 email: z.string(),

2373 name: z.string(),

2374 organizationId: z.string(),

2375 }),

2376 create: async (data, ctx) => {

2377 // Suggested: return createUser({ ...data, password: 'test-password' })

Medium

Secret Pattern

Hardcoded password in dist/index.js

dist/index.jsView on unpkg · L2377

2378 // Found at: src/services/user.service.ts:42 \u2014 UserService.create()

2379 throw new Error('TODO: implement')

2380 },

2381 teardown: async (record, ctx) => {

2382 // Suggested: await db.user.delete({ where: { id: record.id } })

2383 // Cascade: will also delete Settings (FK constraint)

2384 throw new Error('TODO: implement')

2385 },

2386})

2387\`\`\`

2388

2389## Tool usage guidance

2390

2391- Use list_directory ONCE at root to understand project layout, then use grep/glob for targeted discovery

2392- Use grep to find ALL model definitions \u2014 adapt your search patterns to the framework you discover

2393- Use next_model to process models one at a time from the queue \u2014 never pick models yourself

2394- Use read_file on creation files found by grep

2395- Do NOT call list_directory on every subdirectory \u2014 use grep and glob instead

2396

2397## Rules

Lines 3947-3987javascript

3947 inputSchema: z17.object({

3948 instructions: z17.string().describe("Complete, copy-pasteable implementation instructions")

3949 }),

3950 execute: async (input) => {

3951 result = input.instructions;

3952 return { done: true };

3953 }

Source & flagged code

2 flagged · loading source

dist/index.jsView file

3967patternName = generic_password severity = medium line = 3967 matchedText = - Email/... } }

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/index.jsView on unpkg · L3967

2377patternName = generic_password severity = medium line = 2377 matchedText = // Sugge...' })

Medium

Secret Pattern

Hardcoded password in dist/index.js

dist/index.jsView on unpkg · L2377

Findings

5 Medium5 Low

MediumSecret Patterndist/index.js

MediumDynamic Require

MediumNetwork

MediumEnvironment Vars

MediumSecret Patterndist/index.js

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

2 flagged

dist/index.jsView file

Lines 2357-2397javascript

2357- Dependents (independently_created: false) with owner chains

2358- Dual-creation models (both true AND non-empty created_by)

2359- Dependency graph summary (which models must exist before others)

2360

2361### 2. factory-scaffold.ts

2362

2363A TypeScript file with defineFactory() stubs for every model with independently_created: true.

2364

2365Format:

2366\`\`\`typescript

2367import { defineFactory } from '@autonoma-ai/sdk'

2368import { z } from 'zod'

2369

2370export const User = defineFactory({

2371 inputSchema: z.object({

2372 email: z.string(),

2373 name: z.string(),

2374 organizationId: z.string(),

2375 }),

2376 create: async (data, ctx) => {

2377 // Suggested: return createUser({ ...data, password: 'test-password' })

Medium

Secret Pattern

Hardcoded password in dist/index.js

dist/index.jsView on unpkg · L2377

2378 // Found at: src/services/user.service.ts:42 \u2014 UserService.create()

2379 throw new Error('TODO: implement')

2380 },

2381 teardown: async (record, ctx) => {

2382 // Suggested: await db.user.delete({ where: { id: record.id } })

2383 // Cascade: will also delete Settings (FK constraint)

2384 throw new Error('TODO: implement')

2385 },

2386})

2387\`\`\`

2388

2389## Tool usage guidance

2390

2391- Use list_directory ONCE at root to understand project layout, then use grep/glob for targeted discovery

2392- Use grep to find ALL model definitions \u2014 adapt your search patterns to the framework you discover

2393- Use next_model to process models one at a time from the queue \u2014 never pick models yourself

2394- Use read_file on creation files found by grep

2395- Do NOT call list_directory on every subdirectory \u2014 use grep and glob instead

2396

2397## Rules

Lines 3947-3987javascript

3947 inputSchema: z17.object({

3948 instructions: z17.string().describe("Complete, copy-pasteable implementation instructions")

3949 }),

3950 execute: async (input) => {

3951 result = input.instructions;

3952 return { done: true };

3953 }