registry / @desplega.ai/agent-fs / 0.15.2
@desplega.ai/agent-fs@0.15.2
Agent-first filesystem backed by S3
AI Security Review
scanned 27d ago · by lpm-firewall-aiSource inspection found vendor-directed anonymous usage telemetry with an opt-out and shell commands confined to explicit onboarding. No credential exfiltration or install-time attack behavior was established.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Telemetry runs when the agent-fs server starts unless disabled; Docker commands run only when the user invokes onboarding.
Impact
The inspected behavior exposes no credentials or unrelated project control surface; onboarding performs local Docker setup.
Mechanism
Telemetry posts anonymous event and usage metadata. Onboarding checks Docker and starts or creates the agent-fs MinIO container.
AI rationale
Source inspection found vendor-directed anonymous usage telemetry with an opt-out and shell commands confined to explicit onboarding. No credential exfiltration or install-time attack behavior was established.
Evidence
package.jsondist/cli.js
Network endpoints1
proxy.desplega.sh/v1/events
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- `package.json` defines only a `prepublishOnly` build hook; it does not define an install-time hook.
- `dist/cli.js` sends anonymous telemetry to `https://proxy.desplega.sh/v1/events`; its payload contains product/event metadata and usage properties, with an opt-out gate.
- `dist/cli.js` uses shell commands for Docker setup inside the explicit `onboard` command.
Evidence against
- No inspected source showed environment credentials being collected or sent to the telemetry endpoint.
- The CLI’s API client uses its configured agent-fs API URL and sends its API key as a bearer credential to that service.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
8 flaggeddist/cli.jsView file
274ORDER BY distance
L275: LIMIT ?`).all(r,t,JSON.stringify([...s]),Math.min(d,Mx));if(c.length===0)break;let l=e.select({id:re.id,path:re.filePath,content:re.content,author:P.author,modifiedAt:P.modifiedAt}...
L276: (${_.path} >= ${d} AND ${_.path} < ${l})
...
L282: `:`[${n[d]}\r
L283: ]`;continue}if(o+=n[d],n[d]==="\\")i=!0;else if(s&&n[d]==="]")s=!1;else if(!s&&n[d]==="[")s=!0}try{new RegExp(o)}catch{return console.warn(`Could not convert regex pattern at ${t.c...
L284: data: {"driveId":"drive-id","at":"2026-09-30T12:00:00.000Z"}
...
L287:
L288: `}},"x-sse-events":{ready:{type:"object",required:["driveId","at"],properties:{driveId:{type:"string"},at:{type:"string",format:"date-time"}}},"file.changed":{type:"object",require...
L289: Start a daemon with \`agent-fs daemon start\` or se
Critical
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution with blocking evidence.
dist/cli.jsView on unpkg · L2743var ny=Object.create;var{getPrototypeOf:oy,defineProperty:Ti,getOwnPropertyNames:iy}=Object;var $d=Object.prototype.hasOwnProperty;function sy(e){return this[e]}var ay,dy,rt=(e,t,r...
L4: Install with: brew install sqlite`)}var Md=!1;var Ud=f(()=>{hy()});import{mkdirSync as yy,readFileSync as vy,writeFileSync as ki,existsSync as jd}from"fs";import{join as rn}from"pa...
L5: CREATE TABLE IF NOT EXISTS users (
...
L229: END;
L230: `;function Kd(e){if(!e.prepare("PRAGMA table_info(users)").all().some((i)=>i.name==="display_name"))e.exec("ALTER TABLE users ADD COLUMN display_name TEXT");if(e.exec("CREATE INDEX...
L231: ${this.getCanonicalPath(e)}
...
L240: ${Vt.toHex(i)}`}getCanonicalPath({path:e}){if(this.uriEscapePath){let t=[];for(let o of e.split("/")){if(o?.length===0)continue;if(o==="
Findings
3 Critical5 High3 Medium6 Low
CriticalSame File Env Network Executiondist/cli.js
CriticalCredential Exfiltrationdist/cli.js
CriticalTrigger Reachable Dangerous Capabilitydist/cli.js
HighChild Processdist/cli.js
HighShell
HighCommand Output Exfiltrationdist/cli.js
HighTrigger Reachable Credential Exfiltrationdist/cli.js
HighTrigger Reachable Command Output Exfiltrationdist/cli.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowWeak Cryptodist/cli.js
Affected versions and remediation
This report applies to @desplega.ai/agent-fs@0.15.2.
See all versions of @desplega.ai/agent-fs for other recorded verdicts.
- Review the evidence and your use of @desplega.ai/agent-fs@0.15.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.