@desplega.ai/agent-fs@0.18.14
Agent-first filesystem backed by S3
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe daemon sends undisclosed runtime telemetry to the publisher’s endpoint by default, including aggregate usage counts and configuration and platform metadata. It has opt-outs and the inspected payload contains no credentials or file contents, so this warrants a warning rather than a block.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Starts with the agent-fs daemon and sends daily heartbeats by default; environment variables can disable it.
Impact
The publisher receives usage and environment metadata without users being told in the bundled README.
Mechanism
The daemon posts an anonymous install ID, database counts, provider categories, OS and architecture to the telemetry endpoint.
AI rationale
The daemon sends undisclosed runtime telemetry to the publisher’s endpoint by default, including aggregate usage counts and configuration and platform metadata. It has opt-outs and the inspected payload contains no credentials or file contents, so this warrants a warning rather than a block.
Evidence
dist/cli.jsREADME.md~/.agent-fs/config.json
Network endpoints1
proxy.desplega.sh/v1/events
Decision evidence
public snapshotAI called this Suspicious at 94.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The daemon sends user, organization, drive and file counts, storage and embedding provider types, OS and architecture as telemetry.
- Telemetry is sent when the daemon starts and in daily heartbeats to https://proxy.desplega.sh/v1/events.
- Telemetry is enabled by default, with opt-outs through ANONYMIZED_TELEMETRY or DO_NOT_TRACK.
- The package exposes dist/cli.js as its agent-fs command entrypoint; README.md contains no telemetry disclosure.
Evidence against
- The telemetry uses an anonymous install identifier and reports aggregate counts and configuration categories; the inspected payload does not include credentials or file contents.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
8 flaggeddist/cli.jsView file
755ELSE 'viewer'
L756: END`}function Pa(e,t){return e.insert(Y).values({orgId:t.orgId,userId:t.userId,role:t.role}).onConflictDoUpdate({target:[Y.orgId,Y.userId],set:{role:kb(Y.role)}}).returning({role:Y...
L757: ]))`;continue}else if(n[d]==="$"){o+=`($|(?=[\r
...
L764:
L765: `}},"x-sse-events":{"presence.snapshot":{...s,description:"Only sent when presence=1, immediately after ready."},"presence.updated":{type:"object",description:"Only sent when prese...
L766: Start a daemon with \`agent-fs daemon start\` or set AGENT_FS_API_URL to connect to a remote server.`),process.exit(1)}cp=new fD({name:"agent-fs",version:it},{capabilities:{tools:{...
Critical
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution with blocking evidence.
dist/cli.jsView on unpkg · L7553var fS=Object.create;var{getPrototypeOf:gS,defineProperty:fd,getOwnPropertyNames:hS}=Object;var Rp=Object.prototype.hasOwnProperty;function yS(e){return this[e]}var vS,bS,vt=(e,t,r...
L4: Install with: brew install sqlite`)}var _p=!1;var Tp=h(()=>{_S()});import{mkdirSync as TS,readFileSync as kS,writeFileSync as gd,existsSync as kp}from"fs";import{join as ko}from"pa...
L5: CREATE TABLE IF NOT EXISTS org_invites (
...
L294: DELETE FROM meta WHERE key = 'vec_int8_index';
L295: `),!Co(n))n.exec(Qi);return Mp(n),jS(n,{schema:ie})}var le=h(()=>{Tp();wt();Op();Lp();bn()});var Hp;var jp=h(()=>{Hp={name:"agent-fs",version:"0.18.14",packageManager:"bun@1.4.4",p...
L296: ${this.getCanonicalPath(e)}
...
L305: ${Ir.toHex(i)}`}getCanonicalPath({path:e}){if(this.uriEscapePath){let t=[];for(let o of
Critical
Findings
3 Critical5 High3 Medium6 Low
CriticalSame File Env Network Executiondist/cli.js
CriticalCredential Exfiltrationdist/cli.js
CriticalTrigger Reachable Dangerous Capabilitydist/cli.js
HighChild Processdist/cli.js
HighShell
HighCommand Output Exfiltrationdist/cli.js
HighTrigger Reachable Credential Exfiltrationdist/cli.js
HighTrigger Reachable Command Output Exfiltrationdist/cli.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowWeak Cryptodist/cli.js
Affected versions and remediation
This report applies to @desplega.ai/agent-fs@0.18.14.
See all versions of @desplega.ai/agent-fs for other recorded verdicts.
- Review the evidence and your use of @desplega.ai/agent-fs@0.18.14 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.