registry / @botbuddy/cli / 1.64.2
@botbuddy/cli@1.64.2
BotBuddy — Swarm coordination CLI for multi-agent workflows
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe manifest has no install hooks, and the reviewed launcher, credential transport, update check and staging-pool setup have purpose-related triggers and destinations. The scanner flags are consistent with the CLI's process, network, credential and explicit persistence capabilities; I found no concrete malicious behavior.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Trigger
CLI command execution; staging pool setup requires an explicit human-run install command.
Impact
No unauthorized credential transfer, hidden install action, or unrelated persistence was identified.
Mechanism
CLI operations contact configured BotBuddy services; the update check reads public npm metadata. The reviewed staging install verifies a human session before network or filesystem actions.
AI rationale
The manifest has no install hooks, and the reviewed launcher, credential transport, update check and staging-pool setup have purpose-related triggers and destinations. The scanner flags are consistent with the CLI's process, network, credential and explicit persistence capabilities; I found no concrete malicious behavior.
Evidence
~/.botbuddy/update-check.json~/.botbuddy/staging-session-pool/
Network endpoints2
registry.npmjs.org${opts.url}
Decision evidence
public snapshotAI called this Clean at 86.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes the expected BotBuddy CLI binaries and declares no lifecycle scripts.
- The launcher starts delivery only for ordinary CLI invocations; help and inspection paths skip it, and it does not run during package installation.
- The staging session pool is described as human-installed; its install handler checks for a human session before network or file operations.
- Wait requests send the supplied token to the configured service URL, consistent with the CLI's relay workflow.
- The update check fetches the latest package metadata from the official npm registry.
Evidence against
- The CLI has a delivery process and runtime telemetry-related code that merit review, but the inspected launcher and outbox material did not establish unrelated collection or credential theft.
- The package can install a launchd job and handle staging sessions, but the inspected setup is an explicit human-only command tied to the package's purpose.
Behavioral surface
ChildProcessCryptoEnvironmentVars
Source & flagged code
7 flaggedsrc/update-check.mjsView file
16import { readFileSync } from "node:fs";
L17: import { spawn, spawnSync } from "node:child_process";
L18: import { homedir } from "node:os";
High
Child Process
Package source references child process execution.
src/update-check.mjsView on unpkg · L16src/staging-pool/refresh-runtime.mjsView file
26const jobPath = join(app, "job.mjs");
L27: async function owned(path, directory = false, privateFile = false) {
L28: const info = await fs.lstat(path);
...
L42: const before = await configBytes();
L43: const installed = validateInstalledConfig(JSON.parse(before));
L44: const previous = installed.poolBinding;
...
L61: const rows = await fetchRegisteredPools({
L62: exec: (file, args, callOptions) => exec(process.execPath, [file, ...args], callOptions),
L63: botbuddyBin: cliEntry, env, tenant, poolId, preserveAgentContext: true, requireTenantMatch: true,
...
L125: await fs.rename(configTemp, configPath);
L126: return { ok: true, command: "refresh-runtime", tenant, poolId, runtimeVersion: metadata.version, runtimeSha256: contentDigest, personaAliases: Object.keys(next.personas), producer:
Medium
Install Persistence
Source writes installer persistence such as shell profile or service configuration.
Findings
5 High5 Medium3 Low
HighChild Processsrc/update-check.mjs
HighSame File Env Network Executionsrc/pw/daemon.mjs
HighTrigger Reachable Persistencesrc/staging-pool/cli.mjs
HighSemantic Analysis Limitedsrc/agent-credential-store.mjs#virtual:normalized:round1
HighPrevious Version Dangerous Deltasrc/pw/staging-auth.mjs
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencesrc/staging-pool/refresh-runtime.mjs
MediumShips Native Binarydaemon/bin/darwin-arm64/botbuddy-daemon
MediumStructural Risk Force Deep Review
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @botbuddy/cli@1.64.2.
See all versions of @botbuddy/cli for other recorded verdicts.
- Review the evidence and your use of @botbuddy/cli@1.64.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.