registry / @desplega.ai/agent-fs / 0.13.3
@desplega.ai/agent-fs@0.13.3
Agent-first filesystem backed by S3
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe high-risk scanner combination comes from a feature-rich CLI bundle, but source inspection found no install-time trigger or concrete flow that sends harvested credentials or command output to an attacker endpoint. The command execution and network features are explicit runtime functions aligned with the package's stated filesystem service.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A user runs an agent-fs command such as onboarding, server, or mount.
Impact
No unconsented install-time execution, credential harvesting, or exfiltration was found.
Mechanism
User-directed filesystem, S3, HTTP API, and optional FUSE operations.
AI rationale
The high-risk scanner combination comes from a feature-rich CLI bundle, but source inspection found no install-time trigger or concrete flow that sends harvested credentials or command output to an attacker endpoint. The command execution and network features are explicit runtime functions aligned with the package's stated filesystem service.
Decision evidence
public snapshotAI called this Clean at 95.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- Registry installation has no automatic install lifecycle hook; the only lifecycle script is prepublishOnly.
- The bundle exposes a CLI entrypoint and parses commands at runtime rather than executing an install hook.
- The FUSE helper is checked against a packaged SHA-256 manifest.
Evidence against
- User-invoked CLI commands can manage local storage, configuration, and an optional FUSE mount.
- The onboarding command can run Docker commands after explicit invocation.
Behavioral surface
EnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
7 flaggeddist/cli.jsView file
214ORDER BY distance
L215: LIMIT ?`).all(s,r),c=[],l=new Set;for(let u of a){let p=e.db.select().from(d.contentChunks).where(Fs(d.contentChunks.id,u.chunk_id)).get();if(!p||p.driveId!==e.driveId)continue;if(...
L216: ]))`;continue}else if(n[c]==="$"){o+=`($|(?=[\r
...
L218: `:`[${n[c]}\r
L219: ]`;continue}if(o+=n[c],n[c]==="\\")s=!0;else if(i&&n[c]==="]")i=!1;else if(!i&&n[c]==="[")i=!0}try{new RegExp(o)}catch{return console.warn(`Could not convert regex pattern at ${t.c...
L220: Start a daemon with \`agent-fs daemon start\` or set AGENT_FS_API_URL to connect to a remote server.`),process.exit(1)}Gi=new WE({name:"agent-fs",version:Oe},{capabilities:{tools:{...
Critical
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution with blocking evidence.
dist/cli.jsView on unpkg · L2143var of=Object.create;var{getPrototypeOf:sf,defineProperty:Io,getOwnPropertyNames:af}=Object;var cf=Object.prototype.hasOwnProperty;function df(e){return this[e]}var lf,uf,De=(e,t,r...
L4: Install with: brew install sqlite`)}var Qi=!1;var Zi=f(()=>{yf()});import{mkdirSync as vf,readFileSync as bf,writeFileSync as So,existsSync as ta}from"fs";import{join as Ar}from"pa...
L5: CREATE TABLE IF NOT EXISTS users (
...
L188: ${It.toHex(s)}`}getCanonicalPath({path:e}){if(this.uriEscapePath){let t=[];for(let o of e.split("/")){if(o?.length===0)continue;if(o===".")continue;if(o==="..")t.pop();else t.push(...
L189: `);return this.signString(g,{signingDate:r,signingRegion:i,signingService:s})}async signMessage(e,{signingDate:t=new Date,signingRegion:r,signingService:n}){return this.signEvent({...
L
Critical
Findings
3 Critical3 High3 Medium6 Low
CriticalSame File Env Network Executiondist/cli.js
CriticalCredential Exfiltrationdist/cli.js
CriticalTrigger Reachable Dangerous Capabilitydist/cli.js
HighCommand Output Exfiltrationdist/cli.js
HighTrigger Reachable Credential Exfiltrationdist/cli.js
HighTrigger Reachable Command Output Exfiltrationdist/cli.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowWeak Cryptodist/cli.js
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to @desplega.ai/agent-fs@0.13.3.
See all versions of @desplega.ai/agent-fs for other recorded verdicts.
- Review the evidence and your use of @desplega.ai/agent-fs@0.13.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.