@desplega.ai/agent-fs@0.18.6
Agent-first filesystem backed by S3
AI Security Review
scanned 10d ago · by lpm-firewall-aiThe CLI performs default-on telemetry disclosure of an install identifier and aggregate usage and host metadata to a fixed endpoint. The inspected source does not show secret collection or a lifecycle attack, so a warning is appropriate.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Starting the agent-fs daemon while telemetry is enabled by default.
Impact
This discloses usage and host metadata to the telemetry service unless the user sets an opt-out variable.
Mechanism
The daemon generates or reads a persistent install identifier and posts it with aggregate database counts, provider categories, operating system, architecture, and version.
AI rationale
The CLI performs default-on telemetry disclosure of an install identifier and aggregate usage and host metadata to a fixed endpoint. The inspected source does not show secret collection or a lifecycle attack, so a warning is appropriate.
Evidence
dist/cli.js~/.agent-fs/config.json
Network endpoints1
proxy.desplega.sh/v1/events
Decision evidence
public snapshotAI called this Suspicious at 78.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The CLI starts its telemetry routine when the daemon starts, unless an environment opt-out is set.
- By default, the routine sends an install identifier, aggregate database counts, provider categories, operating system, and architecture to a fixed telemetry endpoint.
- The package exposes the CLI through `dist/cli.js`; the telemetry is runtime behavior, not an install hook.
Evidence against
- The telemetry payload is labeled anonymous and contains aggregate counts rather than file contents or credentials.
- The inspected Google GenAI dependency declares a no-op preinstall command.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
8 flaggeddist/cli.jsView file
707};
L708: `,Ky;var Jc=h(()=>{Ky=new WeakMap});import{and as Wy,eq as Zs,inArray as Pk}from"drizzle-orm";async function ea(e,t,r,n){let o=e.$client,i=[],s=new Set;while(i.length<n){let a=Math...
L709: (${C.path} >= ${d} AND ${C.path} < ${l})
...
L711: (${C.path} >= ${c} AND ${C.path} < ${u})
L712: )`)}}if(t.parentId)r.push(K(C.parentId,t.parentId));else if(t.parentId===void 0&&!t.resolved)r.push(na`${C.parentId} IS NULL`),r.push(K(C.resolved,!1));else if(t.parentId===void 0&...
L713: ]))`;continue}else if(n[d]==="$"){o+=`($|(?=[\r
...
L720:
L721: `}},"x-sse-events":{"presence.snapshot":{...s,description:"Only sent when presence=1, immediately after ready."},"presence.updated":{type:"object",description:"Only sent when prese...
L722: Start a daemon with \`agent-fs daemon start\` or set
Critical
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution with blocking evidence.
dist/cli.jsView on unpkg · L7073var cI=Object.create;var{getPrototypeOf:lI,defineProperty:Fa,getOwnPropertyNames:uI}=Object;var ju=Object.prototype.hasOwnProperty;function pI(e){return this[e]}var mI,fI,ft=(e,t,r...
L4: Install with: brew install sqlite`)}var Hu=!1;var Bu=h(()=>{II()});import{mkdirSync as SI,readFileSync as xI,writeFileSync as ja,existsSync as qu}from"fs";import{join as po}from"pa...
L5: CREATE TABLE IF NOT EXISTS users (
...
L254: DELETE FROM meta WHERE key = 'vec_int8_index';
L255: `),!fo(n))n.exec(Di);return Xu(n),LI(n,{schema:se})}var me=h(()=>{Bu();ht();Gu();pn()});var ep;var Zu=h(()=>{ep={name:"agent-fs",version:"0.18.6",packageManager:"bun@1.4.1",private...
L256: ${this.getCanonicalPath(e)}
...
L265: ${fr.toHex(i)}`}getCanonicalPath({path:e}){if(this.uriEscapePath){let t=[];for(let o of e.spli
Findings
3 Critical5 High3 Medium6 Low
CriticalSame File Env Network Executiondist/cli.js
CriticalCredential Exfiltrationdist/cli.js
CriticalTrigger Reachable Dangerous Capabilitydist/cli.js
HighChild Processdist/cli.js
HighShell
HighCommand Output Exfiltrationdist/cli.js
HighTrigger Reachable Credential Exfiltrationdist/cli.js
HighTrigger Reachable Command Output Exfiltrationdist/cli.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowWeak Cryptodist/cli.js
Affected versions and remediation
This report applies to @desplega.ai/agent-fs@0.18.6.
See all versions of @desplega.ai/agent-fs for other recorded verdicts.
- Review the evidence and your use of @desplega.ai/agent-fs@0.18.6 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.