registry / @botbuddy/cli / 1.63.37
@botbuddy/cli@1.63.37
BotBuddy — Swarm coordination CLI for multi-agent workflows
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe flagged process, network, credential, and persistence behavior has contextual, user-facing purposes. The package has no lifecycle script, relay credentials are used for relay requests, and staging-pool persistence is initiated through an explicit human-gated command.
Static reason
No blocking static signals were detected.
Trigger
Version checks run for most CLI commands; relay requests run for requested waits; staging-pool persistence requires an explicit install command.
Impact
No unauthorized credential transfer, hidden install action, or unrelated persistence was found.
Mechanism
The CLI fetches package-version metadata, sends validated session credentials to its configured relay, and can create a LaunchAgent for an explicitly installed staging pool.
AI rationale
The flagged process, network, credential, and persistence behavior has contextual, user-facing purposes. The package has no lifecycle script, relay credentials are used for relay requests, and staging-pool persistence is initiated through an explicit human-gated command.
Evidence
~/.botbuddy/update-check.json~/.botbuddy/staging-session-pool/<pool_id>
Network endpoints2
registry.npmjs.orgapi.bot-buddy.ai
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes CLI binaries and library exports and declares no lifecycle script.
- The update check fetches package version metadata from registry.npmjs.org; it does not include host or project data in that request.
- Relay waits validate the session-token format and send the token to the configured relay endpoint; the default is the BotBuddy relay.
- Staging-pool installation is an explicit command gated as human-only and requires a tenant.
- Runtime refresh accepts only tenant and pool identifiers and validates the existing pool before updating it.
Evidence against
- When invoked, staging-pool install writes a LaunchAgent configuration and starts the job.
- Most CLI commands perform a version check against the npm registry; wait, telemetry, usage, test-ingest, and JSON invocations are excluded.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkWebSocket
Source & flagged code
6 flaggedsrc/update-check.mjsView file
16import { readFileSync } from "node:fs";
L17: import { spawn, spawnSync } from "node:child_process";
L18: import { homedir } from "node:os";
High
Child Process
Package source references child process execution.
src/update-check.mjsView on unpkg · L16src/staging-pool/refresh-runtime.mjsView file
26const jobPath = join(app, "job.mjs");
L27: async function owned(path, directory = false, privateFile = false) {
L28: const info = await fs.lstat(path);
...
L42: const before = await configBytes();
L43: const installed = validateInstalledConfig(JSON.parse(before));
L44: const previous = installed.poolBinding;
...
L61: const rows = await fetchRegisteredPools({
L62: exec: (file, args, callOptions) => exec(process.execPath, [file, ...args], callOptions),
L63: botbuddyBin: cliEntry, env, tenant, poolId, preserveAgentContext: true, requireTenantMatch: true,
...
L125: await fs.rename(configTemp, configPath);
L126: return { ok: true, command: "refresh-runtime", tenant, poolId, runtimeVersion: metadata.version, runtimeSha256: contentDigest, personaAliases: Object.keys(next.personas), producer:
Medium
Install Persistence
Source writes installer persistence such as shell profile or service configuration.
Findings
4 High5 Medium3 Low
HighChild Processsrc/update-check.mjs
HighSame File Env Network Executionsrc/pw/daemon.mjs
HighTrigger Reachable Persistencesrc/staging-pool/cli.mjs
HighSemantic Analysis Limitedsrc/agent-credential-store.mjs#virtual:normalized:round1
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencesrc/staging-pool/refresh-runtime.mjs
MediumShips Native Binarydaemon/bin/darwin-arm64/botbuddy-daemon
MediumStructural Risk Force Deep Review
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @botbuddy/cli@1.63.37.
See all versions of @botbuddy/cli for other recorded verdicts.
- Review the evidence and your use of @botbuddy/cli@1.63.37 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.