registry / @desplega.ai/agent-fs / 0.18.13
@desplega.ai/agent-fs@0.18.13
Agent-first filesystem backed by S3
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe flagged process execution is part of the user-invoked onboarding flow, and embedding keys are used with the configured provider. The vendor telemetry helper sends events as anonymous and supports opt-out; the reviewed code does not show credential or command-output exfiltration.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Users invoke agent-fs commands; telemetry can run during server activity, and Docker checks run during onboarding.
Impact
No evidence showed credentials or command output being sent to an unrelated host, or harmful actions running without a user request.
Mechanism
Configured embedding keys are passed to their selected provider. Anonymous product events are posted to the vendor telemetry endpoint; local storage onboarding checks Docker.
AI rationale
The flagged process execution is part of the user-invoked onboarding flow, and embedding keys are used with the configured provider. The vendor telemetry helper sends events as anonymous and supports opt-out; the reviewed code does not show credential or command-output exfiltration.
Network endpoints1
proxy.desplega.sh
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package exposes a CLI for an agent filesystem and declares only a prepublishOnly build script, which is not a registry-install hook.
- The telemetry helper sends anonymous product events to the package vendor’s telemetry endpoint; it honors opt-out environment variables.
- Embedding credentials are used to initialize the selected embedding provider, including OpenRouter when configured.
- Shell commands check Docker availability as part of the explicit onboard setup flow for local MinIO storage.
Evidence against
- The CLI has an automatic telemetry path to proxy.desplega.sh, though the event payload identifies the actor as anonymous and the helper supports opt-out.
- The CLI reads API keys from environment variables for embedding providers, but the reviewed code uses them with their configured provider.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkShell
HighEntropyStrings
Source & flagged code
8 flaggeddist/cli.jsView file
755ELSE 'viewer'
L756: END`}function Da(e,t){return e.insert(Y).values({orgId:t.orgId,userId:t.userId,role:t.role}).onConflictDoUpdate({target:[Y.orgId,Y.userId],set:{role:Ab(Y.role)}}).returning({role:Y...
L757: ]))`;continue}else if(n[d]==="$"){o+=`($|(?=[\r
...
L764:
L765: `}},"x-sse-events":{"presence.snapshot":{...s,description:"Only sent when presence=1, immediately after ready."},"presence.updated":{type:"object",description:"Only sent when prese...
L766: Start a daemon with \`agent-fs daemon start\` or set AGENT_FS_API_URL to connect to a remote server.`),process.exit(1)}sp=new lD({name:"agent-fs",version:it},{capabilities:{tools:{...
Critical
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution with blocking evidence.
dist/cli.jsView on unpkg · L7553var lS=Object.create;var{getPrototypeOf:uS,defineProperty:md,getOwnPropertyNames:pS}=Object;var Sp=Object.prototype.hasOwnProperty;function mS(e){return this[e]}var fS,gS,vt=(e,t,r...
L4: Install with: brew install sqlite`)}var xp=!1;var Ap=h(()=>{SS()});import{mkdirSync as xS,readFileSync as AS,writeFileSync as fd,existsSync as Rp}from"fs";import{join as _o}from"pa...
L5: CREATE TABLE IF NOT EXISTS org_invites (
...
L294: DELETE FROM meta WHERE key = 'vec_int8_index';
L295: `),!ko(n))n.exec(Qi);return Np(n),MS(n,{schema:oe})}var le=h(()=>{Ap();wt();_p();Dp();bn()});var Up;var $p=h(()=>{Up={name:"agent-fs",version:"0.18.13",packageManager:"bun@1.4.4",p...
L296: ${this.getCanonicalPath(e)}
...
L305: ${Ir.toHex(i)}`}getCanonicalPath({path:e}){if(this.uriEscapePath){let t=[];for(let o of
Critical
Findings
3 Critical5 High3 Medium6 Low
CriticalSame File Env Network Executiondist/cli.js
CriticalCredential Exfiltrationdist/cli.js
CriticalTrigger Reachable Dangerous Capabilitydist/cli.js
HighChild Processdist/cli.js
HighShell
HighCommand Output Exfiltrationdist/cli.js
HighTrigger Reachable Credential Exfiltrationdist/cli.js
HighTrigger Reachable Command Output Exfiltrationdist/cli.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowWeak Cryptodist/cli.js
Affected versions and remediation
This report applies to @desplega.ai/agent-fs@0.18.13.
See all versions of @desplega.ai/agent-fs for other recorded verdicts.
- Review the evidence and your use of @desplega.ai/agent-fs@0.18.13 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.