Loading npm security reports…

@gatetest/cli: AI-agent control-surface risk | LPM Firewall

registry / @gatetest/cli / 1.61.1

@gatetest/cli@1.61.1

GateTest — 121-module QA gate with MCP. Eyes (screenshot live pages), ears (production errors), hands (verify fixes worked). Security, supply chain, AI safety, mutation testing. Iterative Claude fix loop. Replaces SonarQube + Snyk + ESLint + 10 others.

AI Security Review

scanned 19d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. The MCP server supplies an instruction that attempts to control an AI client's review process. It tells the client to avoid manual inspection and to prioritize this package's scanner.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

A user connects an AI client to the gatetest MCP server and the client receives the advertised tools.

Impact

An AI client may be steered away from independent inspection and toward package-directed actions.

Mechanism

AI-agent prompt injection through an MCP tool description.

Policy narrative

When an AI client lists this MCP server's tools, it receives scan_local with imperative instructions declaring it the mandatory first step and forbidding manual file inspection or code review beforehand. The server publishes that tool list directly. This is a concrete attempt to alter the AI client's decision process, rather than a neutral tool description.

AI rationale

The package embeds active AI-directed instructions intended to suppress independent review. This is malicious control-hijacking behavior even though it is not installed through an npm lifecycle hook.

Evidence

bin/gatetest-mcp.mjs

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 96.0% confidence with low false-positive risk.

Source & flagged code

9 flagged · loading source

bin/gatetest.jsView file

857async function runAutoPr(summary, projectRoot, args) { L858: const { execSync } = require('child_process'); L859: const { runFixBatch } = require('../src/core/cli-fix-orchestrator');

High

Child Process

Package source references child process execution.

bin/gatetest.jsView on unpkg · L857

lib/sweep-steps.jsView file

100const commandLine = ['npx', ...args].join(' '); L101: return exec(commandLine, [], { ...opts, shell: true }); L102: }

High

Shell

Package source references shell execution.

lib/sweep-steps.jsView on unpkg · L100

bin/gatetest-promote.jsView file

35L36: const fs = require('fs'); L37: const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/gatetest-promote.jsView on unpkg · L35

src/core/direct-repair.jsView file

28const crypto = require('crypto'); L29: const { spawnSync } = require('child_process'); L30: const { siteHost } = require('./site-url'); ... L56: try { L57: const raw = JSON.parse(fs.readFileSync(file, 'utf8')); L58: for (const [k, v] of Object.entries(raw)) this.store.set(k, v); ... L82: encoding: 'utf8', L83: env: { ...process.env, GIT_TERMINAL_PROMPT: '0', ...env }, L84: timeout: 120_000, ... L86: if (result.status !== 0) { L87: throw new Error(`git ${args[0]} failed: ${(result.stderr || '').trim()}`); L88: }

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/core/direct-repair.jsView on unpkg · L28

src/app-server.jsView file

22L23: const http = require('http'); L24: const crypto = require('crypto'); ... L31: // execSync, so reaching for it is a visible change rather than a one-liner. L32: const { execFileSync } = require('child_process'); L33: L34: const PORT = process.env.PORT || 3333; L35: const APP_ID = process.env.GATETEST_APP_ID;

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

src/app-server.jsView on unpkg · L22

src/core/doctor.jsView file

20Source sends the broad process environment to a literal external destination. L20: const path = require('path'); L21: const { execSync } = require('child_process'); L22: const { apiUrl: anthropicApiUrl, apiVersion: anthropicVersion } = require('./anthropic-config'); ... L54: } catch (err) { L55: return { ok: false, error: err.message || String(err), output: err.stdout || '' }; L56: } ... L74: try { L75: const res = await fetch(anthropicApiUrl(), { L76: method: 'POST', ... L81: }, L82: body: JSON.stringify({ L83: model: 'claude-sonnet-5',

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

src/core/doctor.jsView on unpkg · L20

src/core/ssrf-guard.jsView file

19* validateDomainForProbing(), which already covers more ground than L20: * a plain private-range blocklist (0.x, metadata hostnames by name, L21: * reserved TLDs). ... L26: L27: const dns = require("dns").promises; L28: const { validateDomainForProbing } = require("./pentest/dns-verify");

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

src/core/ssrf-guard.jsView on unpkg · L19

bin/gatetest-blame.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 25

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/gatetest-blame.js#virtual:normalized:round1View on unpkg

src/modules/security.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @gatetest/cli@1.61.0 matchedIdentity = npm:QGdhdGV0ZXN0L2NsaQ:1.61.0 similarity = 0.475 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/modules/security.jsView on unpkg

Source & flagged code

9 flagged

bin/gatetest.jsView file

Lines 837-877javascript

837 ' to .gatetest.json.\x1b[0m\n'

838 );

839 } catch { /* best-effort notice */ } // error-ok

840}

841

842/**

843 * Auto-PR runner — applies AI-driven fixes to every finding that has a file

844 * path, then opens a pull request via the `gh` CLI.

845 *

846 * Uses the full production fix pipeline (iterative retry loop, syntax gate,

847 * regression test generation, rich PR body) — same pipeline as /api/scan/fix.

848 *

849 * Returns { prUrl, fixesApplied, error }. Never throws — the gate's exit

850 * code is the authoritative signal; the auto-PR is a value-add on top.

851 *

852 * Pre-conditions checked at runtime:

853 * - We're inside a git repository

854 * - `gh` CLI is on PATH and authenticated (or GH_TOKEN is set)

855 * - ANTHROPIC_API_KEY is set

856 */

857async function runAutoPr(summary, projectRoot, args) {

858 const { execSync } = require('child_process');

859 const { runFixBatch } = require('../src/core/cli-fix-orchestrator');

High

Child Process

Package source references child process execution.

bin/gatetest.jsView on unpkg · L857

860 const { resolveModelChoice, CHEAP_MODEL } = require('../src/core/engine-models');

861

862 function sh(cmd, opts) {

863 return execSync(cmd, { cwd: projectRoot, encoding: 'utf8', stdio: ['pipe', 'pipe', 'pipe'], ...opts });

864 }

865

866 // Model choice: --model flag > GATETEST_FIX_MODEL env > CHEAP_MODEL.

867 // Validated BEFORE the key check so a bad name fails fast and keyless.

868 let fixModel = CHEAP_MODEL;

869 const rawModel = args.model || process.env.GATETEST_FIX_MODEL;

870 if (rawModel) {

871 const choice = resolveModelChoice(rawModel);

872 if (!choice.ok) return { error: choice.error };

873 fixModel = choice.model;

874 }

875

876 // Pre-flight checks

877 try { sh('git rev-parse --git-dir'); }

lib/sweep-steps.jsView file

Lines 80-120javascript

80 stderr,

81 exitCode,

82 spawnError,

83 };

84}

85

86/**

87 * Run an `npx <args...>` command cross-platform.

88 *

89 * Windows can't spawnSync a bare "npx" (it's a .cmd shim) without a shell —

90 * and as of Node's CVE-2024-27980 fix, spawning a .cmd/.bat file directly

91

bin/gatetest-promote.jsView file

Lines 15-55javascript

15 * USAGE

16 * gatetest-promote --recipe-store <path-or-url> [options]

17 *

18 *

src/core/direct-repair.jsView file

Lines 8-48javascript

8 * 2. scan(workspace) — run GateTest engine on the local clone

9 * 3. repair(workspace, findings) — apply patches directly to files on disk

10 * - check pattern cache first (no Claude call needed for known fixes)

11 *

src/app-server.jsView file

Lines 2-42javascript

2 * GateTest GitHub App Server

3 *

4 * A lightweight GitHub App that:

5 * 1. Receives webhooks (push, pull_request)

6 * 2.

src/core/doctor.jsView file

Lines 1-40javascript

1'use strict';

2

3/**

4 * GateTest Doctor — runs every prerequisite check and reports back in

5 * plain English what's working, what's broken, and exactly how to fix it.

6 *

7 * Designed for non-experts. The output uses tick / cross / warning symbols,

8 * NEVER assumes the reader knows what "ANTHROPIC_API_KEY" means, and

9 * gives the exact command to fix each missing piece.

10 *

11 * Run: `gatetest --doctor`

src/core/ssrf-guard.jsView file

Lines 1-39javascript

1"use strict";

2

3/**

4 * SSRF guard for user-supplied URLs — shared by /api/web/scan and

5 * /api/wp/scan (both accept ANY URL from an unauthenticated caller and

6 * fetch it server-side, no signup required).

7 *

8 * Previously each route had its own copy of a hostname-string blocklist

9 * (`localhost` / `127.` / `10.` / etc.) with two gaps: no DNS resolution

10 * (a domain the attacker controls can resolve to 127.0.0.1 or the cloud

bin/gatetest-blame.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 25

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/gatetest-blame.js#virtual:normalized:round1View on unpkg

src/modules/security.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @gatetest/cli@1.61.0 matchedIdentity = npm:QGdhdGV0ZXN0L2NsaQ:1.61.0 similarity = 0.475 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/modules/security.jsView on unpkg