registry / @funny-booth/agent-core / 0.1.10

@funny-booth/agent-core@0.1.10

FUNNY BOOTH 専用AIエージェント起動CLI（salesbot1..10 ランチャー + MCPサーバー）

AI Security Review

scanned 14d ago · by lpm-firewall-ai

A user-run salesbot command launches an agent with a package MCP server. That server sends environment values to the fixed portal and executes a command string from the portal response. The same launch checks npm and can globally install a newer release of this package.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

Running a salesbot bin or agent-core so the launcher starts, and the agent invoking the MCP tool that handles env_vars.

Impact

The portal can receive caller-supplied environment values and choose a local command to run. A later published release can replace the global package without a separate install step.

Mechanism

The launcher writes an mcpServers config that starts node with the portal URL and token, then spawns the agent. The MCP handler POSTs env_vars to the portal and passes a response field to child_process. A newer registry version is installed with a detached global npm install.

Attack narrative

Running a salesbot command starts the launcher. It contacts the portal named in launcher.config.json, writes a local MCP config that starts this package under node with the portal URL and tool token, and spawns the agent with that config. The MCP tool posts mcp_id and env_vars to the portal, then runs a child process on a string taken from the portal JSON. The launch also checks the npm registry and, when a newer version exists, starts a detached global install of this package at latest. The shipped launcher and server are obfuscated.

AI rationale

The MCP handler sends environment values to the fixed portal and executes a command taken from that response, while the launcher can background-install a newer global release. That is remote command execution from a user-run entrypoint, with the portal host set in launcher.config.json.

Evidence

dist/index.jsdist/launcher.js

@funny-booth/agent-core@0.1.10

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code