registry  /  @genex-ai/cli-demo  /  0.30.0

@genex-ai/cli-demo@0.30.0

Set up your ~/.claude workspace, authorize, create a game project, generate AI assets, and publish (genex CLI).

AI Security Review

scanned 1d ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. No confirmed malware or credential exfiltration was found. The main residual risk is first-party agent workspace mutation by an explicit CLI setup/sync workflow.

Static reason
High-risk behavior combination matched malicious policy.
Trigger
User runs genex init or another genex CLI command after genex skills already exist.
Impact
Genex-owned skills/commands/agents may be written into local AI agent workspaces; token is stored locally and used only for Genex API calls.
Mechanism
first-party agent skill/template installation and refresh
Rationale
Static inspection supports a warning for first-party agent extension lifecycle risk, not a publish block: the risky behavior is explicit CLI setup/sync and package-aligned. Scanner credential-exfiltration hints appear to be documented auth, upload, and publish flows using a locally stored Genex token.
Evidence
package.jsondist/index.jsREADME.mdtemplates/~/.claude~/.codex/skills~/.cursor/skills~/.genex/env~/.genex/update-check.json./.genex/project.json./.env./.env.development.local./src/genex.config.ts./.gitignore./public/assets/avatar.vrm
Network endpoints4
demo-api.glotech.worlddemo-web.glotech.worldwss://demo-colyseus.glotech.worldregistry.npmjs.org

Decision evidence

public snapshot
AI called this Suspicious at 86.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
  • dist/index.js bin entry runs main() for user-invoked CLI commands.
  • dist/index.js runInit copies bundled templates into detected ~/.claude, ~/.codex/skills, and ~/.cursor/skills agent workspaces.
  • dist/index.js syncSkills auto-refreshes existing genex-* agent skills on non-init commands.
  • dist/index.js stores GENEX_TOKEN in ~/.genex/env and uses it as Bearer auth to Genex APIs.
Evidence against
  • package.json has no preinstall/install/postinstall lifecycle hooks.
  • Network endpoints are package-aligned defaults: demo-api.glotech.world, demo-web.glotech.world, demo-colyseus.glotech.world, registry.npmjs.org.
  • dist/index.js excludes .env/.env.* and .genex when uploading/pushing project source.
  • child_process use is user-command aligned: opening browser, npm build, git operations, and Windows icacls permission hardening.
  • README.md documents agent template installation, auth token storage, and publish/upload behavior.
Behavioral surface
Source
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
Supply chain
HighEntropyStringsUrlStrings
ManifestNo manifest risk signals triggered.
scanned 20 file(s), 447 KB of source, external domains: 127.0.0.1, demo-api.glotech.world, demo-web.glotech.world, registry.npmjs.org, www.npmjs.com

Source & flagged code

3 flagged · loading source
dist/index.jsView file
10import { fileURLToPath } from "url"; L11: var DEFAULT_AUTH_URL = "https://demo-web.glotech.world"; L12: var DEFAULT_API_URL = "https://demo-api.glotech.world"; ... L18: function getAuthUrl(override) { L19: const raw = override || process.env[AUTH_URL_ENV] || DEFAULT_AUTH_URL; L20: return raw.replace(/\/+$/, ""); ... L30: function getGenexDir() { L31: return path.join(os.homedir(), ".genex"); L32: } ... L43: const here = path.dirname(fileURLToPath(import.meta.url)); L44: const pkg = JSON.parse( L45: fs.readFileSync(path.resolve(here, "..", "package.json"), "utf8")
Critical
Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/index.jsView on unpkg · L10
10Trigger-reachable chain: manifest.bin -> dist/index.js L10: import { fileURLToPath } from "url"; L11: var DEFAULT_AUTH_URL = "https://demo-web.glotech.world"; L12: var DEFAULT_API_URL = "https://demo-api.glotech.world"; ... L18: function getAuthUrl(override) { L19: const raw = override || process.env[AUTH_URL_ENV] || DEFAULT_AUTH_URL; L20: return raw.replace(/\/+$/, ""); ... L30: function getGenexDir() { L31: return path.join(os.homedir(), ".genex"); L32: } ... L43: const here = path.dirname(fileURLToPath(import.meta.url)); L44: const pkg = JSON.parse( L45: fs.readFileSync(path.resolve(here, "..", "package.json"), "utf8")
Critical
Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg · L10
10import { fileURLToPath } from "url"; L11: var DEFAULT_AUTH_URL = "https://demo-web.glotech.world"; L12: var DEFAULT_API_URL = "https://demo-api.glotech.world"; ... L18: function getAuthUrl(override) { L19: const raw = override || process.env[AUTH_URL_ENV] || DEFAULT_AUTH_URL; L20: return raw.replace(/\/+$/, ""); ... L30: function getGenexDir() { L31: return path.join(os.homedir(), ".genex"); L32: } ... L43: const here = path.dirname(fileURLToPath(import.meta.url)); L44: const pkg = JSON.parse( L45: fs.readFileSync(path.resolve(here, "..", "package.json"), "utf8")
Low
Weak Crypto

Package source references weak cryptographic algorithms.

dist/index.jsView on unpkg · L10

Findings

2 Critical3 Medium5 Low
CriticalCredential Exfiltrationdist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowWeak Cryptodist/index.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings