registry / @desplega.ai/agent-fs / 0.13.6
@desplega.ai/agent-fs@0.13.6
Agent-first filesystem backed by S3
AI Security Review
scanned 2mo ago · by lpm-firewall-aiStatic inspection found no install-time execution, self-dependency chain, covert export, or automatic foreign control-surface mutation. Scanner hits arise from a bundled filesystem CLI that accepts configured service credentials and explicitly invoked operational commands.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
User runs an agent-fs command such as onboarding, remote mount, daemon, or filesystem operations.
Impact
The commands can intentionally access configured storage, local agent-fs state, and a user-selected remote service.
Mechanism
User-configured filesystem service client and local daemon tooling.
AI rationale
Static inspection found no install-time execution, self-dependency chain, covert export, or automatic foreign control-surface mutation. Scanner hits arise from a bundled filesystem CLI that accepts configured service credentials and explicitly invoked operational commands.
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes a CLI and has only a prepublish build hook; it has no install-time lifecycle hook.
- The CLI's remote API URL and API key are configuration inputs for a user-selected agent-fs service.
- The flagged process, filesystem, and network primitives implement explicit filesystem, daemon, Docker onboarding, and remote-mount commands rather than an automatic payload.
Evidence against
Behavioral surface
EnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
7 flaggeddist/cli.jsView file
222ORDER BY distance
L223: LIMIT ?`).all(r,t,JSON.stringify([...i]),Math.min(c,Ab));if(d.length===0)break;let l=e.select({id:W.id,path:W.filePath,content:W.content,author:_.author,modifiedAt:_.modifiedAt}).f...
L224: ]))`;continue}else if(n[c]==="$"){o+=`($|(?=[\r
...
L226: `:`[${n[c]}\r
L227: ]`;continue}if(o+=n[c],n[c]==="\\")s=!0;else if(i&&n[c]==="]")i=!1;else if(!i&&n[c]==="[")i=!0}try{new RegExp(o)}catch{return console.warn(`Could not convert regex pattern at ${t.c...
L228: Start a daemon with \`agent-fs daemon start\` or set AGENT_FS_API_URL to connect to a remote server.`),process.exit(1)}Wi=new GE({name:"agent-fs",version:Be},{capabilities:{tools:{...
Critical
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution with blocking evidence.
dist/cli.jsView on unpkg · L2223var cf=Object.create;var{getPrototypeOf:df,defineProperty:yo,getOwnPropertyNames:lf}=Object;var ta=Object.prototype.hasOwnProperty;function uf(e){return this[e]}var pf,mf,Ke=(e,t,r...
L4: Install with: brew install sqlite`)}var ra=!1;var na=m(()=>{Ef()});import{mkdirSync as If,readFileSync as Sf,writeFileSync as vo,existsSync as sa}from"fs";import{join as xr}from"pa...
L5: CREATE TABLE IF NOT EXISTS users (
...
L188: ${Tt.toHex(s)}`}getCanonicalPath({path:e}){if(this.uriEscapePath){let t=[];for(let o of e.split("/")){if(o?.length===0)continue;if(o===".")continue;if(o==="..")t.pop();else t.push(...
L189: `);return this.signString(f,{signingDate:r,signingRegion:i,signingService:s})}async signMessage(e,{signingDate:t=new Date,signingRegion:r,signingService:n}){return this.signEvent({...
L
Critical
Findings
3 Critical3 High3 Medium6 Low
CriticalSame File Env Network Executiondist/cli.js
CriticalCredential Exfiltrationdist/cli.js
CriticalTrigger Reachable Dangerous Capabilitydist/cli.js
HighCommand Output Exfiltrationdist/cli.js
HighTrigger Reachable Credential Exfiltrationdist/cli.js
HighTrigger Reachable Command Output Exfiltrationdist/cli.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowWeak Cryptodist/cli.js
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to @desplega.ai/agent-fs@0.13.6.
See all versions of @desplega.ai/agent-fs for other recorded verdicts.
- Review the evidence and your use of @desplega.ai/agent-fs@0.13.6 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.