registry / @blockrun/franklin / 3.30.0

@blockrun/franklin@3.30.0

Franklin Agent — The AI agent with a wallet. Spends USDC autonomously to get real work done. Pay per action, no subscriptions.

AI Security Review

scanned 2d ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Explicit `franklin init` or runtime agent invocation of Surf tools.

Impact

Changes an AI-agent client control surface and can spend funds from the configured wallet during enabled tool use.

Mechanism

explicit agent-proxy persistence and wallet-backed paid API requests

Rationale

No concrete malicious chain was established by source inspection, but explicit AI-agent configuration mutation, login persistence, dynamic user-plugin loading, and automatic wallet payment signing create real high-impact capability risk.

Evidence

package.jsondist/index.jsdist/commands/init.jsdist/tools/surf.jsdist/plugins/registry.js

Decision evidence

public snapshot

AI called this Suspicious at 88.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

`dist/commands/init.js` explicitly writes `~/.claude/settings.json`.
`init` installs a macOS `LaunchAgent` that starts its proxy on login.
`dist/tools/surf.js` signs x402 payment payloads with the configured wallet key.
`dist/plugins/registry.js` dynamically imports user plugins from `~/.blockrun/plugins`.

Evidence against

`package.json` has no preinstall, install, postinstall, or prepare hook.
The Claude and LaunchAgent changes require explicit `franklin init` execution.
Wallet signing is part of documented paid-request handling, not credential exfiltration.
No source evidence found of private-key transmission, hidden payload download, or destructive install-time behavior.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 236 file(s), 2.39 MB of source, external domains: 127.0.0.1, 1rpc.io, api.blockrun.ai, api.coingecko.com, api.telegram.org, base.meowrpc.com, base.publicnode.com, basescan.org, blockrun.ai, bridge.polymarket.com, data-api.polymarket.com, docs.polymarket.com, example.com, fonts.googleapis.com, fonts.gstatic.com, franklin.run, github.com, html.duckduckgo.com, lite-api.jup.ag, mainnet.base.org, nodejs.org, pay.coinbase.com, pm-egress-vbsbhh7lea-an.a.run.app, polygon-rpc.com, polygon.llamarpc.com, polygonscan.com, polymarket.com, registry.npmjs.org, relayer-v2.polymarket.com, sol.blockrun.ai, solscan.io, www.apple.com, www.w3.org, www.youtube.com, x.com

Source & flagged code

3 flagged

dist/plugins/registry.jsView file

Lines 76-116javascript

76 return found;

77}

78// ─── Loading ──────────────────────────────────────────────────────────────

79/** Load a single plugin from its directory */

80export async function loadPlugin(manifest, pluginDir) {

81 // Resolve entry path. Plugin's entry should point to a built JS file.

82 // For bundled plugins, entry might be "dist/index.js" but we ship from src/.

83 // Check both — prefer dist if present.

84 let entryPath = path.join(pluginDir, manifest.entry);

85 if (!fs.existsSync(entryPath)) {

86 // Try .js extension swap (TS source vs built)

87 const jsEntry = entryPath.replace(/\.ts$/, '.js');

88 if (fs.existsSync(jsEntry))

89 entryPath = jsEntry;

90 }

91 if (!fs.existsSync(entryPath)) {

92 process.stderr.write(`[plugin:${manifest.id}] entry not found: ${manifest.entry}\n`);

93 return null;

94 }

95 try {

96 // Dynamic import — works for both ESM and CJS

97 const mod = await import(entryPath);

98 const plugin = mod.default ?? mod.plugin ?? mod;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/plugins/registry.jsView on unpkg · L96

99 if (!plugin || typeof plugin !== 'object') {

100 process.stderr.write(`[plugin:${manifest.id}] invalid plugin export\n`);

101 return null;

102 }

103 // Inject manifest if plugin didn't include it

104 plugin.manifest = manifest;

105 return plugin;

106 }

107 catch (err) {

108 process.stderr.write(`[plugin:${manifest.id}] load failed: ${err.message}\n`);

109 return null;

110 }

111}

112/** Discover and load all plugins. Returns the loaded registry. */

113export async function loadAllPlugins() {

114 if (loaded.size > 0)

115 return loaded;

116 const manifests = discoverPluginManifests();

dist/agent/context.jsView file

Lines 1-26javascript

1/**

2 * Context Manager for Franklin

3 * Assembles system instructions, reads project config, injects environment info.

4 */

5import fs from 'node:fs';

6import path from 'node:path';

7import { execSync } from 'node:child_process';

8import { BLOCKRUN_DIR }

Source & flagged code

3 flagged · loading source

dist/plugins/registry.jsView file

96// Dynamic import — works for both ESM and CJS L97: const mod = await import(entryPath); L98: const plugin = mod.default ?? mod.plugin ?? mod;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/plugins/registry.jsView on unpkg · L96

dist/agent/context.jsView file

6import path from 'node:path'; L7: import { execSync } from 'node:child_process'; L8: import { BLOCKRUN_DIR } from '../config.js'; ... L95: L96: **No internal-language leakage.** Always write your visible response in the same language the user is using. If your private reasoning happens in a different language than the user... L97: ... L146: 2. If SearchX returns empty, tell the user "No posts found" and suggest a different keyword. Do NOT fall back to WebSearch/WebFetch — they will return non-X content that you must N... L147: 3. NEVER fabricate X post URLs. Every link you show MUST come from SearchX results. If a URL doesn't start with "https://x.com/", do NOT present it as an X post. L148: 4. Present results as a numbered list. Each item: author, snippet, URL from SearchX, and a 1-2 sentence suggested reply. ... L197: - Chain selection: ~/.blockrun/payment-chain ("base" or "solana"). Legacy file ~/.blockrun/.chain may also exist on installs that haven't migrated; canonical is payment-chain. L198: - Spending data: L199: - ~/.blockrun/franklin-stats.json — rolling totals + per-model breakdown (what \`franklin stats\` reads).

Critical

Wallet Drain

Source uses private key material to transfer cryptocurrency funds.

dist/agent/context.jsView on unpkg · L6

6Trigger-reachable chain: manifest.exports -> dist/index.js -> dist/commands/telegram.js -> dist/agent/context.js L6: import path from 'node:path'; L7: import { execSync } from 'node:child_process'; L8: import { BLOCKRUN_DIR } from '../config.js'; ... L95: L96: **No internal-language leakage.** Always write your visible response in the same language the user is using. If your private reasoning happens in a different language than the user... L97: ... L146: 2. If SearchX returns empty, tell the user "No posts found" and suggest a different keyword. Do NOT fall back to WebSearch/WebFetch — they will return non-X content that you must N... L147: 3. NEVER fabricate X post URLs. Every link you show MUST come from SearchX results. If a URL doesn't start with "https://x.com/", do NOT present it as an X post. L148: 4. Present results as a numbered list. Each item: author, snippet, URL from SearchX, and a 1-2 sentence suggested reply. ... L197: - Chain selection: ~/.blockrun/payment-chain ("base" or "solana"). Legacy file ~/.blockrun/.chain may also exist on installs that haven't migrated; canonical is payment-chain. L198: - Spending data: L199: - ~/.blockrun/franklin-stats.json — rolling…

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/agent/context.jsView on unpkg · L6

Findings

2 Critical4 Medium4 Low

CriticalWallet Draindist/agent/context.js

CriticalTrigger Reachable Dangerous Capabilitydist/agent/context.js

MediumDynamic Requiredist/plugins/registry.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

88%Warn

Verdict confidence

IntentDangerous Capability

TypeAI-agent capability abuse

False-positive riskLow

Review stagesource_first_review

Firewall policyWarn-only AI-agent capability risk

Package metadata

npm

Maintainerskillerqueenandy, 1bcmax

Version3.32.1

PublishedJul 11, 2026

LicenseApache-2.0

Dependencies23

Integrityverified

Package size2.92 MB

Files487

Keywordsfranklinautonomous-economic-agentai-agentwallet-nativeagent-with-walletx402usdcpay-per-action

LinksRepository Homepage Issues

Runtime surface

package.json

Entrypointsexports mapbin → franklin

Runtimenode >=20.19.0

Artifact4.89 MB · 487 files1 signature(s) · provenance

Install lifecycleNo install hooks · other: build, dev, start, test +5

Behavioral surface

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocketHighEntropyStringsUrlStringsManifest: clean

Source & flagged code

3 flagged

dist/plugins/registry.jsView file

Lines 76-116javascript

76 return found;

77}

79/** Load a single plugin from its directory */

80export async function loadPlugin(manifest, pluginDir) {

81 // Resolve entry path. Plugin's entry should point to a built JS file.

82 // For bundled plugins, entry might be "dist/index.js" but we ship from src/.

83 // Check both — prefer dist if present.

84 let entryPath = path.join(pluginDir, manifest.entry);

85 if (!fs.existsSync(entryPath)) {

86 // Try .js extension swap (TS source vs built)

87 const jsEntry = entryPath.replace(/\.ts$/, '.js');

88 if (fs.existsSync(jsEntry))

89 entryPath = jsEntry;

90 }

91 if (!fs.existsSync(entryPath)) {

92 process.stderr.write(`[plugin:${manifest.id}] entry not found: ${manifest.entry}\n`);

93 return null;

94 }

95 try {

96 // Dynamic import — works for both ESM and CJS

97 const mod = await import(entryPath);

98 const plugin = mod.default ?? mod.plugin ?? mod;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/plugins/registry.jsView on unpkg · L96

99 if (!plugin || typeof plugin !== 'object') {

100 process.stderr.write(`[plugin:${manifest.id}] invalid plugin export\n`);

101 return null;

102 }

103 // Inject manifest if plugin didn't include it

104 plugin.manifest = manifest;

105 return plugin;

106 }

107 catch (err) {

108 process.stderr.write(`[plugin:${manifest.id}] load failed: ${err.message}\n`);

109 return null;

110 }

111}

112/** Discover and load all plugins. Returns the loaded registry. */

113export async function loadAllPlugins() {

114 if (loaded.size > 0)

115 return loaded;

116 const manifests = discoverPluginManifests();

dist/agent/context.jsView file

Lines 1-26javascript

1/**

2 * Context Manager for Franklin

3 * Assembles system instructions, reads project config, injects environment info.

4 */

5import fs from 'node:fs';

6import path from 'node:path';

7import { execSync } from 'node:child_process';

8import { BLOCKRUN_DIR }