@catchmexz/fedin-vibe-mcp-server-workbuddy@2.0.0
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe flagged credential flow is not automatic: it runs through an explicit, authenticated deployment action to the package’s own service. However, the archive can include common environment files with third-party credentials, creating a meaningful disclosure risk that the deployment code does not address.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A logged-in user invokes the MCP deploy tool with a project path.
Impact
Secrets in included files such as `.env` or `.env.production` are disclosed to the deployment service; the source does not show whether the service needs or safely handles them.
Mechanism
The tool recursively archives project files, omitting only selected patterns such as `.env.local` and `.env.*.local`, then posts the archive to Fedin’s deployment API.
AI rationale
The flagged credential flow is not automatic: it runs through an explicit, authenticated deployment action to the package’s own service. However, the archive can include common environment files with third-party credentials, creating a meaningful disclosure risk that the deployment code does not address.
Evidence
dist/operations/deploy/deploy.jsdist/tool-handlers/deploy.jsProject files under the path supplied to the deploy toolA temporary `project-<timestamp>.zip` in that project directory
Network endpoints1
ai.fedin.cn/api/edgeone-pages/deploy
Decision evidence
public snapshotAI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The deploy tool archives the project directory, excluding `.env.local` and `.env.*.local` but not `.env` or other environment files.
- The archive is uploaded to `https://ai.fedin.cn/api/edgeone-pages/deploy` when the user invokes the deploy tool.
Evidence against
- Deployment is an explicit tool action that requires login; no install lifecycle scripts are declared.
- The upload goes to the package’s own Fedin deployment API and serves its stated deployment purpose.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
5 flaggeddist/auth/pending-login.jsView file
1import http from "http";
L2: import { spawn } from "child_process";
L3: const LOGIN_TIMEOUT_MS = Number(process.env.FEDIN_LOGIN_TIMEOUT_MS) || 180_000;
High
Child Process
Package source references child process execution.
dist/auth/pending-login.jsView on unpkg · L11import http from "http";
L2: import { spawn } from "child_process";
L3: const LOGIN_TIMEOUT_MS = Number(process.env.FEDIN_LOGIN_TIMEOUT_MS) || 180_000;
L4: const FEDIN_MCP_LOGIN_BASE = process.env.FEDIN_MCP_LOGIN_URL || "https://ai.fedin.cn/mcp-login";
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/auth/pending-login.jsView on unpkg · L1dist/operations/deploy/deploy.jsView file
Findings
2 Critical3 High3 Medium5 Low
CriticalCredential Exfiltrationdist/operations/deploy/deploy.js
CriticalTrigger Reachable Dangerous Capabilitydist/operations/deploy/deploy.js
HighChild Processdist/auth/pending-login.js
HighSame File Env Network Executiondist/auth/pending-login.js
HighTrigger Reachable Credential Exfiltrationdist/operations/deploy/deploy.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @catchmexz/fedin-vibe-mcp-server-workbuddy@2.0.0.
See all versions of @catchmexz/fedin-vibe-mcp-server-workbuddy for other recorded verdicts.
- Review the evidence and your use of @catchmexz/fedin-vibe-mcp-server-workbuddy@2.0.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.