@chozzz/vargos@3.2.20
Moved: please install @vargos-labs/vargos (repo now at github.com/vargos-labs/vargos)
Self-hosted agent OS with persistent memory, multi-channel presence, tools, scheduling, and sub-agent orchestration
AI Security Review
scanned 14d ago · by lpm-firewall-aiThe bundled skill deliberately extracts and prints a Claude bearer token, creating a concrete credential exposure capability when explicitly invoked. Because inspection found no automatic invocation or remote exfiltration, this warrants a warning rather than a publish block.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
Explicitly running the token-capture skill script, including through its documented usage.
Impact
The token is exposed in local command output and may be available to whoever can read that output; no remote recipient was identified in inspected code.
Mechanism
The script starts a local MITM proxy, disables TLS verification for the proxied Claude CLI request, captures the Authorization header for /v1/messages, and prints the bearer value.
AI rationale
The bundled skill deliberately extracts and prints a Claude bearer token, creating a concrete credential exposure capability when explicitly invoked. Because inspection found no automatic invocation or remote exfiltration, this warrants a warning rather than a publish block.
Evidence
dist/.templates/agent/skills/token-capture/scripts/capture-bearer-token.shdist/.templates/agent/skills/token-capture/SKILL.mddist/lib/templates.jsdist/cli/chat.js
Network endpoints1
api.anthropic.com
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The package manifest defines a postinstall hook that rebuilds better-sqlite3; no evidence inspected ties it to the token-capture behavior.
- The token-capture skill is bundled and copied into the Vargos data directory when missing during explicit chat startup.
- When explicitly run, the script captures the Authorization header from Claude /v1/messages traffic and prints the bearer value.
- The agent source loads workspace prompt files; the inspected location does not show token forwarding or agent configuration mutation.
Evidence against
- The capture is initiated by running a specifically named skill script; inspection found no package install hook that invokes it.
- The script routes the Claude CLI request through a local proxy and outputs the captured value locally; inspected code showed no remote token recipient.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
Source & flagged code
10 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = pnpm rebuild better-sqlite3
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = pnpm rebuild better-sqlite3
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/core/edges.jsView file
37continue;
L38: const mod = await import(modulePath);
L39: const priority = mod.BOOT_PRIORITY ?? DEFAULT_BOOT_PRIORITY;
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/core/edges.jsView on unpkg · L37Findings
7 High6 Medium4 Low
HighInstall Time Lifecycle Scriptspackage.json
HighPayload In Excluded Dirdist/.templates/agent/skills/token-capture/scripts/capture-bearer-token.sh
HighSemantic Analysis Limiteddist/lib/migrate.js
HighKnown Malware Source Similaritydist/edge/web/index.js
HighKnown Malware Source Similaritydist/cli/chat.js
HighKnown Malware Source Similaritydist/cli/enrich.js
HighPrevious Version Dangerous Deltadist/edge/web/index.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Requiredist/core/edges.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperdist/.templates/agent/skills/token-capture/scripts/capture-bearer-token.sh
Affected versions and remediation
This report applies to @chozzz/vargos@3.2.20.
See all versions of @chozzz/vargos for other recorded verdicts.
- Review the evidence and your use of @chozzz/vargos@3.2.20 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.