registry / @botbuddy/cli / 1.64.0
@botbuddy/cli@1.64.0
BotBuddy — Swarm coordination CLI for multi-agent workflows
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe manifest has no lifecycle scripts, and the flagged network, process and persistence behavior is consistent with this coordination CLI’s purpose. Credential-bearing relay calls use a per-session token for BotBuddy, while setup actions require explicit commands.
Static reason
No blocking static signals were detected.
Trigger
CLI commands; staging-pool and daemon installation require explicit subcommands.
Impact
No unauthorized credential transfer, install-time action or unrelated persistence was identified.
Mechanism
Wait operations send a session token to the configured BotBuddy relay. Update checks query npm, while staging-pool and daemon setup are command-driven.
AI rationale
The manifest has no lifecycle scripts, and the flagged network, process and persistence behavior is consistent with this coordination CLI’s purpose. Credential-bearing relay calls use a per-session token for BotBuddy, while setup actions require explicit commands.
Network endpoints2
api.bot-buddy.airegistry.npmjs.org
Decision evidence
public snapshotAI called this Clean at 92.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes CLI binaries and package-specific reporter and telemetry modules.
- Wait requests use the per-session BotBuddy token for relay registration; the code says the command fails closed without it.
- Staging pool installation is a named human-only operation that requires a tenant.
- Daemon updater installation runs only through the explicit `bb daemon updater-install` command.
- The update check is described as a throttled npm version check; updating is a separate `botbuddy update` command.
- The launcher’s delivery process handles pending terminal updates from `bb run` and is skipped for help and inspection.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
6 flaggedsrc/update-check.mjsView file
16import { readFileSync } from "node:fs";
L17: import { spawn, spawnSync } from "node:child_process";
L18: import { homedir } from "node:os";
High
Child Process
Package source references child process execution.
src/update-check.mjsView on unpkg · L16src/staging-pool/refresh-runtime.mjsView file
26const jobPath = join(app, "job.mjs");
L27: async function owned(path, directory = false, privateFile = false) {
L28: const info = await fs.lstat(path);
...
L42: const before = await configBytes();
L43: const installed = validateInstalledConfig(JSON.parse(before));
L44: const previous = installed.poolBinding;
...
L61: const rows = await fetchRegisteredPools({
L62: exec: (file, args, callOptions) => exec(process.execPath, [file, ...args], callOptions),
L63: botbuddyBin: cliEntry, env, tenant, poolId, preserveAgentContext: true, requireTenantMatch: true,
...
L125: await fs.rename(configTemp, configPath);
L126: return { ok: true, command: "refresh-runtime", tenant, poolId, runtimeVersion: metadata.version, runtimeSha256: contentDigest, personaAliases: Object.keys(next.personas), producer:
Medium
Install Persistence
Source writes installer persistence such as shell profile or service configuration.
Findings
4 High5 Medium3 Low
HighChild Processsrc/update-check.mjs
HighSame File Env Network Executionsrc/pw/daemon.mjs
HighTrigger Reachable Persistencesrc/staging-pool/cli.mjs
HighSemantic Analysis Limitedsrc/agent-credential-store.mjs#virtual:normalized:round1
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencesrc/staging-pool/refresh-runtime.mjs
MediumShips Native Binarydaemon/bin/darwin-arm64/botbuddy-daemon
MediumStructural Risk Force Deep Review
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @botbuddy/cli@1.64.0.
See all versions of @botbuddy/cli for other recorded verdicts.
- Review the evidence and your use of @botbuddy/cli@1.64.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.