registry / @desplega.ai/agent-fs / 0.13.0
@desplega.ai/agent-fs@0.13.0
Agent-first filesystem backed by S3
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThe scanner conflates this package's intended filesystem/S3/MCP capabilities with credential exfiltration. Direct inspection found no install-time execution or concrete unconsented collection/exfiltration chain.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Explicit CLI commands such as mount, daemon, MCP, or filesystem operations.
Impact
Intended access to configured storage and agent-fs endpoints.
Mechanism
User-configured filesystem service and optional FUSE helper.
AI rationale
The scanner conflates this package's intended filesystem/S3/MCP capabilities with credential exfiltration. Direct inspection found no install-time execution or concrete unconsented collection/exfiltration chain.
Evidence
package.jsondist/cli.jsdist/fuse-bin.manifest.json
Network endpoints1
localhost:9000
Decision evidence
public snapshotAI called this Clean at 96.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- Explicit mount command can spawn a FUSE helper.
- Runtime reads S3/API credentials and contacts its configured agent-fs service.
Evidence against
- No preinstall, install, or postinstall hook; prepublishOnly only builds the release artifact.
- Default API/S3 targets are localhost; remote API URLs are supplied by user configuration, environment, or flags.
- FUSE helper hash is verified before spawn when its manifest is present.
- No source evidence of harvesting unrelated credentials or exfiltrating process environment.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
8 flaggeddist/cli.jsView file
173ORDER BY distance
L174: LIMIT ?`).all(D,T),A=[],R=new Set;for(let L of _){let X=N.db.select().from(f.contentChunks).where(W0(f.contentChunks.id,L.chunk_id)).get();if(!X||X.driveId!==N.driveId)continue;if(...
L175: ]))`;continue}else if(w[A]==="$"){$+=`($|(?=[\r
...
L177: `:`[${w[A]}\r
L178: ]`;continue}if($+=w[A],w[A]==="\\")D=!0;else if(U&&w[A]==="]")U=!1;else if(!U&&w[A]==="[")U=!0}try{new RegExp($)}catch{return console.warn(`Could not convert regex pattern at ${E.c...
L179: Start a daemon with \`agent-fs daemon start\` or set AGENT_FS_API_URL to connect to a remote server.`),process.exit(1)}CD=new VQ({name:"agent-fs",version:PN},{capabilities:{tools:{...
Critical
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution with blocking evidence.
dist/cli.jsView on unpkg · L1733var iR=Object.create;var{getPrototypeOf:yR,defineProperty:U$,getOwnPropertyNames:uR}=Object;var kR=Object.prototype.hasOwnProperty;function hR(N){return this[N]}var xR,lR,gN=(N,E,T...
L4: Install with: brew install sqlite`)}var KD=!1;var jD=Z(()=>{pR()});import{mkdirSync as tR,readFileSync as rR,writeFileSync as _$,existsSync as gD}from"fs";import{join as WT}from"pa...
L5: CREATE TABLE IF NOT EXISTS users (
...
L146: ${IE.toHex(D)}`}getCanonicalPath({path:N}){if(this.uriEscapePath){let E=[];for(let $ of N.split("/")){if($?.length===0)continue;if($===".")continue;if($==="..")E.pop();else E.push(...
L147: `);return this.signString(Q,{signingDate:T,signingRegion:U,signingService:D})}async signMessage(N,{signingDate:E=new Date,signingRegion:T,signingService:w}){return this.signEvent({...
L
Critical
Findings
3 Critical5 High3 Medium6 Low
CriticalSame File Env Network Executiondist/cli.js
CriticalCredential Exfiltrationdist/cli.js
CriticalTrigger Reachable Dangerous Capabilitydist/cli.js
HighChild Processdist/cli.js
HighShell
HighCommand Output Exfiltrationdist/cli.js
HighTrigger Reachable Credential Exfiltrationdist/cli.js
HighTrigger Reachable Command Output Exfiltrationdist/cli.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowWeak Cryptodist/cli.js
Affected versions and remediation
This report applies to @desplega.ai/agent-fs@0.13.0.
See all versions of @desplega.ai/agent-fs for other recorded verdicts.
- Review the evidence and your use of @desplega.ai/agent-fs@0.13.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.