@funny-booth/agent-core@0.1.39
AIエージェント起動CLI（共有ランチャー + MCPサーバー）
AI Security Review
scanned 1d ago · by lpm-firewall-aiThe feedback instruction asks an agent to report without user request, creating a real but conditional agent capability risk. The reviewed excerpts do not establish an automatic send, payload, or recipient, so blocking is not supported.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
An agent follows the feedback instruction and invokes the reporting tool.
Impact
An agent could disclose report content to the configured service without a recipient-specific user request.
Mechanism
The packaged feedback instruction tells the agent to send qualifying reports to maintainers even when the user has not asked; the portal client supports authenticated requests to a configured portal.
AI rationale
The feedback instruction asks an agent to report without user request, creating a real but conditional agent capability risk. The reviewed excerpts do not establish an automatic send, payload, or recipient, so blocking is not supported.
Evidence
dist/feedback.jsdist/index.jsdist/portalClient.js
Decision evidence
public snapshotAI called this Suspicious at 72.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The feedback module instructs the agent to send reports to maintainers even when the user has not asked.
- The package exposes the feedback module through its runtime entrypoint, so the instruction can reach an agent using the MCP server.
- The portal client sends authenticated requests to its configured portal URL; the reviewed excerpts do not establish the feedback recipient or payload.
Evidence against
- Feedback reporting depends on the agent invoking the tool; the inspected source does not establish an automatic install-time or import-time send.
Behavioral surface
CryptoDynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedObfuscated
NoLicense
Source & flagged code
4 flagged · loading sourcedist/secretValues.jsView file
7// 受け取るのは Mod（Claude Code の中のプログラム）だけで、AI や会話の記録には渡らない。
L8: const vault_1 = require("./vault");
L9: exports.REDACT_MIN = 6;
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/secretValues.jsView on unpkg · L7dist/launcher.jsView file
1'use strict';const _0x2bfca3=_0x10cb;(function(_0x269402,_0x44f9ec){const _0x27b019=_0x10cb,_0x80fdb9=_0x269402();while(!![]){try{const _0x28d988=parseInt(_0x27b019(0xb0))/0x1*(par...
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/launcher.jsView on unpkg · L1dist/feedback.jsView file
Findings
1 Critical3 High4 Medium5 Low
CriticalPrevious Version Dangerous Deltadist/index.js
HighSame File Env Network Executiondist/launcher.js
HighObfuscated Payload Loaderdist/feedback.js
HighObfuscated
MediumDynamic Requiredist/secretValues.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowNo License
Affected versions and remediation
This report applies to @funny-booth/agent-core@0.1.39.
See all versions of @funny-booth/agent-core for other recorded verdicts.
- Review the evidence and your use of @funny-booth/agent-core@0.1.39 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.