@companion-ai/feynman@0.5.32
Research-first CLI agent built on Pi and alphaXiv
AI Security Review
scanned 26d ago · by lpm-firewall-aiThe preinstall hook performs a Node version check, while the inspected agent configuration write is user-invoked and limited to missing project files. I classify that concrete agent configuration capability as warning-level risk; the inspected credential use targets the Hugging Face API.
Static reason
One or more suspicious static signals were detected.
Trigger
A user invokes the init command in a project.
Impact
The new AGENTS.md may influence later agent sessions in that project; source inspection did not establish harmful instructions or an attack.
Mechanism
The command creates AGENTS.md only if it does not already exist, and creates session-log directories and a README when absent.
AI rationale
The preinstall hook performs a Node version check, while the inspected agent configuration write is user-invoked and limited to missing project files. I classify that concrete agent configuration capability as warning-level risk; the inspected credential use targets the Hugging Face API.
Evidence
extensions/research-tools/project.ts
Decision evidence
public snapshotAI called this Suspicious at 78.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The preinstall hook only checks the Node.js version.
- The init command is explicitly registered and writes AGENTS.md only when it is absent, along with session-log folders.
- The executable loads the bundled CLI; its child-process helper launches the package’s bundled alpha CLI with inherited arguments and environment.
Evidence against
- The project init command can create an AGENTS.md file in the current project, which can affect later agent behavior.
- Hugging Face requests use HF_TOKEN or HUGGINGFACE_HUB_TOKEN as authorization headers for the Hugging Face API.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsTelemetryUrlStrings
Source & flagged code
5 flaggedpackage.jsonView file
•scripts.preinstall = node ./scripts/check-node-version.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgbin/feynman.jsView file
23if (compareNodeVersions(parseNodeVersion(process.versions.node), parseNodeVersion(MIN_NODE_VERSION)) < 0) {
L24: const isWindows = process.platform === "win32";
L25: console.error(`feynman requires Node.js ${MIN_NODE_VERSION} or newer (detected ${process.versions.node}).`);
L26: console.error(isWindows
L27: ? "Install a supported Node.js release from https://nodejs.org, or use the standalone installer:"
L28: : `Switch to a supported Node release with \`nvm install ${PREFERRED_NODE_MAJOR} && nvm use ${PREFERRED_NODE_MAJOR}\`, or use the standalone installer:`);
...
L35:
L36: // `--version` needs only package.json; answer it without loading the CLI.
L37: if (process.argv.length === 3 && process.argv[2] === "--version") {
L38: const { readFileSync } = await import("node:fs");
L39: conso
High
Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
bin/feynman.jsView on unpkg · L23Findings
3 High5 Medium5 Low
HighInstall Time Lifecycle Scriptspackage.json
HighSandbox Evasion Gated Capabilitybin/feynman.js
HighSemantic Analysis Limiteddist/cli.js#virtual:normalized:round1
MediumDynamic Requirebin/feynman.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperscripts/install/install-skills.sh
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to @companion-ai/feynman@0.5.32.
See all versions of @companion-ai/feynman for other recorded verdicts.
- Review the evidence and your use of @companion-ai/feynman@0.5.32 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.