registry / @desplega.ai/agent-fs / 0.12.0
@desplega.ai/agent-fs@0.12.0
Agent-first filesystem backed by S3
AI Security Review
scanned 3mo ago · by lpm-firewall-aiScanner findings conflate documented, user-configured storage and embedding traffic with credential exfiltration. Source inspection found no install-time execution or unconsented collection/exfiltration chain.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Explicit agent-fs commands such as daemon start, mount, onboard, or semantic indexing.
Impact
Configured data may be stored in the selected S3 backend or submitted to the selected embedding provider as part of requested features.
Mechanism
Configured storage and embedding API client operations
AI rationale
Scanner findings conflate documented, user-configured storage and embedding traffic with credential exfiltration. Source inspection found no install-time execution or unconsented collection/exfiltration chain.
Evidence
package.jsondist/cli.jsdist/fuse-bin.manifest.jsonREADME.md~/.agent-fs/config.json~/.agent-fs/agent-fs.db~/.agent-fs/storage
Network endpoints1
localhost:9000
Decision evidence
public snapshotAI called this Clean at 95.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- dist/cli.js can send configured file content to S3 and selected embedding providers.
- dist/cli.js runs Docker/FUSE helpers only through explicit onboard or mount commands.
Evidence against
- package.json has no preinstall/install/postinstall hook; prepublishOnly is publish-time build only.
- CLI entrypoint requires an explicit user command; imports do not start network activity.
- Remote API URL and API key come from explicit flags, AGENT_FS_* variables, or its own config.
- Embedding clients use user-supplied OpenAI/Gemini keys for the documented semantic-search feature.
- FUSE helper is hash-checked against dist/fuse-bin.manifest.json before spawning.
- No eval/new Function, arbitrary payload download, or AI-agent configuration writes found.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
8 flaggeddist/cli.jsView file
173ORDER BY distance
L174: LIMIT ?`).all(D,T),f=[],R=new Set;for(let L of _){let X=N.db.select().from(A.contentChunks).where(G0(A.contentChunks.id,L.chunk_id)).get();if(!X||X.driveId!==N.driveId)continue;if(...
L175: ]))`;continue}else if(w[f]==="$"){$+=`($|(?=[\r
...
L177: `:`[${w[f]}\r
L178: ]`;continue}if($+=w[f],w[f]==="\\")D=!0;else if(U&&w[f]==="]")U=!1;else if(!U&&w[f]==="[")U=!0}try{new RegExp($)}catch{return console.warn(`Could not convert regex pattern at ${E.c...
L179: Start a daemon with \`agent-fs daemon start\` or set AGENT_FS_API_URL to connect to a remote server.`),process.exit(1)}VD=new WQ({name:"agent-fs",version:PN},{capabilities:{tools:{...
Critical
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution with blocking evidence.
dist/cli.jsView on unpkg · L1733var gR=Object.create;var{getPrototypeOf:qR,defineProperty:$$,getOwnPropertyNames:vR}=Object;var iR=Object.prototype.hasOwnProperty;function yR(N){return this[N]}var uR,kR,gN=(N,E,T...
L4: Install with: brew install sqlite`)}var FD=!1;var PD=Z(()=>{dR()});import{mkdirSync as oR,readFileSync as cR,writeFileSync as D$,existsSync as jD}from"fs";import{join as IT}from"pa...
L5: CREATE TABLE IF NOT EXISTS users (
...
L146: ${nE.toHex(D)}`}getCanonicalPath({path:N}){if(this.uriEscapePath){let E=[];for(let $ of N.split("/")){if($?.length===0)continue;if($===".")continue;if($==="..")E.pop();else E.push(...
L147: `);return this.signString(Q,{signingDate:T,signingRegion:U,signingService:D})}async signMessage(N,{signingDate:E=new Date,signingRegion:T,signingService:w}){return this.signEvent({...
L
Critical
Findings
3 Critical5 High3 Medium6 Low
CriticalSame File Env Network Executiondist/cli.js
CriticalCredential Exfiltrationdist/cli.js
CriticalTrigger Reachable Dangerous Capabilitydist/cli.js
HighChild Processdist/cli.js
HighShell
HighCommand Output Exfiltrationdist/cli.js
HighTrigger Reachable Credential Exfiltrationdist/cli.js
HighTrigger Reachable Command Output Exfiltrationdist/cli.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowWeak Cryptodist/cli.js
Affected versions and remediation
This report applies to @desplega.ai/agent-fs@0.12.0.
See all versions of @desplega.ai/agent-fs for other recorded verdicts.
- Review the evidence and your use of @desplega.ai/agent-fs@0.12.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.