@copilotkit/runtime@1.83.0
<img src="https://github.com/user-attachments/assets/0a6b64d9-e193-4940-a3f6-60334ac34084" alt="banner" style="border-radius: 12px; border: 2px solid #d6d4fa;" />
AI Security Review
scanned 7d ago · by lpm-firewall-aiSource inspection confirms that configured public API keys can enter telemetry events, but it does not resolve the telemetry destination or establish malicious intent. Treat this as an unresolved credential disclosure risk and warn rather than block.
Static reason
One or more suspicious static signals were detected.
Trigger
A runtime captures telemetry while default telemetry is enabled; a v2 run also captures a key supplied in the request header.
Impact
The key may be disclosed to the telemetry recipient; its destination and exposure scope remain unresolved from the inspected source.
Mechanism
The key is included in telemetry event properties and passed to a shared dependency's Lambda telemetry client. Environment flags disable telemetry, but no recipient-specific consent guard was found in the inspected paths.
AI rationale
Source inspection confirms that configured public API keys can enter telemetry events, but it does not resolve the telemetry destination or establish malicious intent. Treat this as an unresolved credential disclosure risk and warn rather than block.
Evidence
dist/lib/telemetry-client.cjsdist/lib/telemetry-client.mjsdist/v2/runtime/handlers/handle-run.mjsdist/v2/runtime/telemetry/telemetry-client.mjs
Decision evidence
public snapshotAI called this Suspicious at 78.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The legacy telemetry payload includes the configured Copilot Cloud public API key, and the v2 run handler adds a request header key to a telemetry event.
- Telemetry is sent through a shared dependency's Lambda client; the inspected runtime source does not establish its recipient or a recipient-specific consent guard.
- Intelligence learning requests send a separately configured API key to the configured Intelligence API URL, with HTTP protocol and embedded-credential checks.
- The manifest identifies the package and version and contains no install lifecycle hook.
Evidence against
- The key is described as a public API key, and telemetry can be disabled with environment flags; these facts reduce the severity but do not establish the telemetry recipient or affirmative consent for sending the key.
Behavioral surface
CryptoDynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStrings
Source & flagged code
3 flaggeddist/langgraph.cjsView file
1require("reflect-metadata");
L2: Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/langgraph.cjsView on unpkg · L1dist/v2/runtime/handlers/intelligence/annotate.cjsView file
6package = @copilotkit/runtime; repositoryIdentity = copilotkit; dependency = @copilotkit/shared
L6: const require_runtime$1 = require('../../core/runtime.cjs');
L7: let _copilotkit_shared = require("@copilotkit/shared");
L8:
High
Copied Package Dependency Bridge
Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.
dist/v2/runtime/handlers/intelligence/annotate.cjsView on unpkg · L6dist/lib/telemetry-client.mjs
Findings
1 High6 Medium5 Low
HighCopied Package Dependency Bridgedist/v2/runtime/handlers/intelligence/annotate.cjs
MediumDynamic Requiredist/langgraph.cjs
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumWildcard Dependency
MediumAi Review Evidencedist/lib/telemetry-client.mjs
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to @copilotkit/runtime@1.83.0.
See all versions of @copilotkit/runtime for other recorded verdicts.
- Review the evidence and your use of @copilotkit/runtime@1.83.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.