registry / @fieldwangai/agentflow / 0.1.46

@fieldwangai/agentflow@0.1.46

Orchestration system for long-running complex agent tasks using Cursor, OpenCode, or Claude Code as execution backends

AI Security Review

scanned 5d ago · by lpm-firewall-ai

No confirmed malicious attack surface was established. Risky primitives are present but are user-invoked workflow features of an agent orchestration CLI, while install-time behavior is limited to copying bundled reference docs.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

npm install runs postinstall; CLI/runtime commands run workflows when invoked by the user

Impact

No confirmed malicious impact from inspected source

Mechanism

package-aligned reference copy and user-invoked agent/workflow execution

Rationale

Static inspection found dangerous capabilities, but they are documented/user-invoked parts of an agent workflow tool rather than stealthy install/import-time behavior. The only lifecycle hook performs a bounded copy of bundled reference markdown and does not harvest or exfiltrate data.

Evidence

package.jsonbin/ensure-workspace-reference.mjsbin/agentflow.mjsbin/lib/api-runner.mjsbin/pipeline/run-tool-nodejs.mjsbin/lib/hub.mjsbin/lib/ui-server.mjsbin/lib/user-env.mjs.workspace/agentflow/reference/*.md~/.agentflow/hub.json~/.skillhub/auth.json~/.cursor/config.json

Network endpoints4

api.openai.com/v1api.anthropic.com/v1/messageshvgnpjuiumxtymksqgki.supabase.coskillhub.bigo.sg/api/v1

Decision evidence

public snapshot

AI called this Clean at 86.0% confidence as Benign with medium false-positive risk.

Evidence for block

package.json has postinstall: node bin/ensure-workspace-reference.mjs
bin/lib/api-runner.mjs exposes LLM tools for read_file/write_file/run_command/list_dir
bin/pipeline/run-tool-nodejs.mjs executes user flow script commands with shell:true for non-node commands

Evidence against

bin/ensure-workspace-reference.mjs only copies bundled reference/*.md into .workspace/agentflow/reference and skips package root
bin/agentflow.mjs CLI entry only initializes i18n, update notifier, and dispatches main()
Network calls are package-aligned: OpenAI/Anthropic API runner, Supabase hub, Skillhub UI lookup, GitLab MR helper
Shell/child_process usage is runtime workflow functionality for agent orchestration, model CLI invocation, git helpers, and user-defined tool_nodejs scripts
No install-time credential reads, exfiltration, persistence, destructive behavior, or AI-agent control-surface mutation found

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 89 file(s), 3.42 MB of source, external domains: 127.0.0.1, agentflow-hub.com, api.anthropic.com, api.openai.com, docs.agentflow-hub.com, github.com, hvgnpjuiumxtymksqgki.supabase.co, pro.reactflow.dev, reactflow.dev, reactjs.org, skillhub.bigo.sg, www.w3.org

Source & flagged code

8 flagged

package.jsonView file

Lines 28-68json

28 "url": "git+https://github.com/pproject-github/agentflow.git"

29 },

30 "homepage": "https://github.com/pproject-github/agentflow#readme",

31 "bugs": {

32 "url": "https://github.com/pproject-github/agentflow/issues"

33 },

34 "publishConfig": {

35 "access": "public",

36 "registry": "https://registry.npmjs.org"

37 },

38 "files": [

39 "bin",

40 "agents",

41 "skills",

42 "builtin/nodes",

43 "builtin/pipelines",

44 "builtin/web-ui/dist",

45 "reference"

46 ],

47 "scripts": {

48 "postinstall": "node bin/ensure-workspace-reference.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L48

49 "build:web-ui": "cd builtin/web-ui && npm install && npm run build",

50 "build:website": "cd website && npm install && npm run build",

51 "dev": "AGENTFLOW_DEV=1 node bin/agentflow.mjs ui",

52 "dev:web": "cd builtin/web-ui && npm run dev",

53 "dev:website": "cd website && npm run dev",

54 "preview:website": "cd website && npm run preview",

55 "prepack": "npm run build:web-ui"

56 },

57 "dependencies": {

58 "busboy": "^1.6.0",

59 "chalk": "^5.6.2",

60 "cli-table3": "^0.6.5",

61 "fflate": "^0.8.2",

62 "js-yaml": "^4.1.0",

63 "markdansi": "^0.2.1",

64 "ora": "^9.3.0",

65 "sharp": "^0.34.5",

66 "update-notifier": "^7.0.0"

67 }

68}

bin/pipeline/post-process-node.mjsView file

Lines 1-32javascript

1#!/usr/bin/env node

2/**

3 * 统一后处理入口：对每个已执行完的节点运行一次。

4 * 1) 若存在本轮的 result 文件（AI/subagent 所写），先规范化 frontmatter 与正文后写回；

5 * 2) 再根据 definitionId 分支：control_if 写 branch，control_if_true/false 写 condition_not_met，tool_user_check/waitForUser 写 pending 等；

6 * 3) 若为 tool_print 则生成 optionalPromptPath 供主 agent 执行；

7 * 4) 最后在 memory 中将该节点 execId +1。

8 * 用法：node post-process-node.mjs <workspaceRoot> <flowName> <uuid> <instanceId> [execId]

9 * 可选 execId：本轮执行的 execId（与 pre-process 输出一致），未传则从 memory 读取。**必须传入**才能正确命中本轮的 result 文件（否则第二轮起 user_check 等不生效）。

10 * 输出（stdout JSON）：{ "ok": true } 或 { "ok": true, "optionalPromptPath": "..." }

bin/pipeline/run-tool-nodejs.mjsView file

Lines 32-72javascript

33function runtimeEnv() {

34 return { ...process.env, ...readMergedEnvObject(process.env.AGENTFLOW_USER_ID || "") };

35}

37function runOnce(workspaceRoot, flowName, uuid,

builtin/web-ui/dist/assets/index-DgQRkS4v.jsView file

39`+g.message)}var n=new it;n.add(a),n.isGeoSVGGraphicRoot=!0;var i=e.width,o=e.height,s=e.viewBoxRect,l=this._boundingRect;if(!l){var u=void 0,f=void 0,v=void 0,h=void 0;if(i!=null?... L40: `+i.message)}return l8(e,n),A(n,function(i){var o=i.name;f8(e,i),h8(e,i);var s=this._specialAreas&&this._specialAreas[o];s&&i.transformTo(s.left,s.top,s.width,s.height)},this),n},r... L41: `))}),t.join(`

Low

Eval

Package source references a known benign dynamic code generation pattern.

builtin/web-ui/dist/assets/index-DgQRkS4v.jsView on unpkg · L39

bin/agentflow.mjsView file

Lines 1-36javascript

1#!/usr/bin/env node

2/**

3 * AgentFlow CLI: drive apply/replay from command line.

4 * Commands: agentflow apply <FlowName> [uuid], agentflow replay [flowName] <uuid> <instanceId>

5 * Cursor agent execution uses --print --output-format stream-json.

6 */

8import { createRequire } from "module";

9import path from "path";

10import

bin/pipeline/compute-cache-md5.mjsView file

Lines 13-53javascript

13 * - payload?: string — 用于算 MD5 的完整字符串：prompt 全文 + "\\n" + forCache 规范化串（可选，便于排查）

14 */

16import crypto from "crypto";

17import fs from "fs";

bin/lib/api-runner.mjsView file

Lines 1-29javascript

1/**

2 * 直调 AI API 运行器，绕过 Cursor/OpenCode CLI 冷启动开销。

3 *

4 * 支持的模型格式（在 flow.yaml 或模型配置中指定）：

5 * api:openai/<model> — OpenAI 或兼容端点（Together/Groq/DeepSeek/Azure 等）

6 * api:anthropic/<model> — Anthropic Claude

7 *

8 * 相关环境变量：

9 * OPENAI_API_KEY — OpenAI 或兼容端点的 API key

10 * OPENAI_BASE_URL — 兼容端点基础 URL（默认 https://api.openai.com/v1）

11 * ANTHROPIC_API_KEY — Anthropic API key

bin/lib/ui-server.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @fieldwangai/agentflow@0.1.44 matchedIdentity = npm:QGZpZWxkd2FuZ2FpL2FnZW50Zmxvdw:0.1.44 similarity = 0.978 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

bin/lib/ui-server.mjsView on unpkg

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/ensure-workspace-reference.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

bin/pipeline/post-process-node.mjsView file

12L13: import { spawnSync } from "child_process"; L14: import fs from "fs";

High

Child Process

Package source references child process execution.

bin/pipeline/post-process-node.mjsView on unpkg · L12

bin/pipeline/run-tool-nodejs.mjsView file

52cwd: workspaceRoot, L53: shell: true, L54: stdio: ["inherit", "pipe", "pipe"],

High

Shell

Package source references shell execution.

bin/pipeline/run-tool-nodejs.mjsView on unpkg · L52

builtin/web-ui/dist/assets/index-DgQRkS4v.jsView file

Low

Eval

Package source references a known benign dynamic code generation pattern.

builtin/web-ui/dist/assets/index-DgQRkS4v.jsView on unpkg · L39

bin/agentflow.mjsView file

16const __dirname = path.dirname(fileURLToPath(import.meta.url)); L17: const require = createRequire(import.meta.url); L18:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/agentflow.mjsView on unpkg · L16

bin/pipeline/compute-cache-md5.mjsView file

33try { L34: const o = JSON.parse(fs.readFileSync(p, "utf-8")); L35: return o.cacheMd5 != null ? String(o.cacheMd5) : "";

Low

Weak Crypto

Package source references weak cryptographic algorithms.

bin/pipeline/compute-cache-md5.mjsView on unpkg · L33

bin/lib/api-runner.mjsView file

9* OPENAI_API_KEY — OpenAI 或兼容端点的 API key L10: * OPENAI_BASE_URL — 兼容端点基础 URL（默认 https://api.openai.com/v1） L11: * ANTHROPIC_API_KEY — Anthropic API key ... L17: import path from "path"; L18: import { spawnSync } from "child_process"; L19: ... L24: const DEFAULT_OPENAI_BASE = "https://api.openai.com/v1"; L25: const MAX_TOOL_ROUNDS = parseInt(process.env.AGENTFLOW_API_MAX_ROUNDS ?? "30", 10) || 30; L26: const MAX_TOKENS = parseInt(process.env.AGENTFLOW_API_MAX_TOKENS ?? "8192", 10) || 8192;

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

bin/lib/api-runner.mjsView on unpkg · L9

bin/lib/ui-server.mjsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

bin/lib/ui-server.mjsView on unpkg

Findings

1 Critical4 High4 Medium7 Low

CriticalPrevious Version Dangerous Deltabin/lib/ui-server.mjs

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processbin/pipeline/post-process-node.mjs

HighShellbin/pipeline/run-tool-nodejs.mjs

HighSame File Env Network Executionbin/lib/api-runner.mjs

MediumDynamic Requirebin/agentflow.mjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvalbuiltin/web-ui/dist/assets/index-DgQRkS4v.js

LowWeak Cryptobin/pipeline/compute-cache-md5.mjs

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

8 flagged

package.jsonView file

Lines 28-68json

28 "url": "git+https://github.com/pproject-github/agentflow.git"

29 },

30 "homepage": "https://github.com/pproject-github/agentflow#readme",

31 "bugs": {

32 "url": "https://github.com/pproject-github/agentflow/issues"

33 },

34 "publishConfig": {

35 "access": "public",

36 "registry": "https://registry.npmjs.org"

37 },

38 "files": [

39 "bin",

40 "agents",

41 "skills",

42 "builtin/nodes",

43 "builtin/pipelines",

44 "builtin/web-ui/dist",

45 "reference"

46 ],

47 "scripts": {

48 "postinstall": "node bin/ensure-workspace-reference.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L48

49 "build:web-ui": "cd builtin/web-ui && npm install && npm run build",

50 "build:website": "cd website && npm install && npm run build",

51 "dev": "AGENTFLOW_DEV=1 node bin/agentflow.mjs ui",

52 "dev:web": "cd builtin/web-ui && npm run dev",

53 "dev:website": "cd website && npm run dev",

54 "preview:website": "cd website && npm run preview",

55 "prepack": "npm run build:web-ui"

56 },

57 "dependencies": {

58 "busboy": "^1.6.0",

59 "chalk": "^5.6.2",

60 "cli-table3": "^0.6.5",

61 "fflate": "^0.8.2",

62 "js-yaml": "^4.1.0",

63 "markdansi": "^0.2.1",

64 "ora": "^9.3.0",

65 "sharp": "^0.34.5",

66 "update-notifier": "^7.0.0"

67 }

68}

bin/pipeline/post-process-node.mjsView file

Lines 1-32javascript

1#!/usr/bin/env node

2/**

3 * 统一后处理入口：对每个已执行完的节点运行一次。

4 * 1) 若存在本轮的 result 文件（AI/subagent 所写），先规范化 frontmatter 与正文后写回；

5 * 2) 再根据 definitionId 分支：control_if 写 branch，control_if_true/false 写 condition_not_met，tool_user_check/waitForUser 写 pending 等；

6 * 3) 若为 tool_print 则生成 optionalPromptPath 供主 agent 执行；

7 * 4) 最后在 memory 中将该节点 execId +1。

8 * 用法：node post-process-node.mjs <workspaceRoot> <flowName> <uuid> <instanceId> [execId]

10 * 输出（stdout JSON）：{ "ok": true } 或 { "ok": true, "optionalPromptPath": "..." }

bin/pipeline/run-tool-nodejs.mjsView file

Lines 32-72javascript

33function runtimeEnv() {

34 return { ...process.env, ...readMergedEnvObject(process.env.AGENTFLOW_USER_ID || "") };

35}

37function runOnce(workspaceRoot, flowName, uuid,

builtin/web-ui/dist/assets/index-DgQRkS4v.jsView file

Low

Eval

Package source references a known benign dynamic code generation pattern.

builtin/web-ui/dist/assets/index-DgQRkS4v.jsView on unpkg · L39

bin/agentflow.mjsView file

Lines 1-36javascript

1#!/usr/bin/env node

2/**

3 * AgentFlow CLI: drive apply/replay from command line.

4 * Commands: agentflow apply <FlowName> [uuid], agentflow replay [flowName] <uuid> <instanceId>

5 * Cursor agent execution uses --print --output-format stream-json.

6 */

8import { createRequire } from "module";

9import path from "path";

10import

bin/pipeline/compute-cache-md5.mjsView file

Lines 13-53javascript

13 * - payload?: string — 用于算 MD5 的完整字符串：prompt 全文 + "\\n" + forCache 规范化串（可选，便于排查）

14 */

16import crypto from "crypto";

17import fs from "fs";

bin/lib/api-runner.mjsView file

Lines 1-29javascript

1/**

2 * 直调 AI API 运行器，绕过 Cursor/OpenCode CLI 冷启动开销。

3 *

4 * 支持的模型格式（在 flow.yaml 或模型配置中指定）：

5 * api:openai/<model> — OpenAI 或兼容端点（Together/Groq/DeepSeek/Azure 等）

6 * api:anthropic/<model> — Anthropic Claude

7 *

8 * 相关环境变量：

9 * OPENAI_API_KEY — OpenAI 或兼容端点的 API key

10 * OPENAI_BASE_URL — 兼容端点基础 URL（默认 https://api.openai.com/v1）

11 * ANTHROPIC_API_KEY — Anthropic API key

bin/lib/ui-server.mjsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

bin/lib/ui-server.mjsView on unpkg