registry / @genex-ai/cli-demo / 0.33.0

@genex-ai/cli-demo@0.33.0

Set up your ~/.claude workspace, authorize, create a game project, generate AI assets, and publish (genex CLI).

AI Security Review

scanned 9h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. The package is a CLI that can install and refresh package-owned AI-agent skills and publish project files after user commands. This is an agent extension lifecycle risk, but source inspection did not confirm malicious exfiltration or install-time hijacking.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

User runs `genex init` or other `genex` commands from the bin entrypoint.

Impact

May modify agent skill directories and upload/push project content to Genex-controlled or server-provided destinations during explicit CLI workflows.

Mechanism

user-invoked Genex workspace setup, token auth, project deploy, and package-owned agent skill sync

Rationale

Source inspection supports a warning for first-party, package-owned AI-agent extension setup and refresh behavior, not a publish block. The scanner's credential-exfiltration hint is explained by normal GENEX_TOKEN auth and deploy APIs with explicit user commands and secret-file exclusions.

Evidence

package.jsondist/index.jsREADME.mdtemplates/skillstemplates/agents/genex-helper.mdtemplates/commands/genex-status.md~/.claude~/.codex/skills~/.cursor/skills~/.genex/env~/.genex/update-check.json.gitignore.genex/project.json.env.env.development.localsrc/genex.config.tssrc/controllerspublic/assets/avatar.vrm

Network endpoints9

demo-web.glotech.worlddemo-api.glotech.worldwss://demo-colyseus.glotech.worldregistry.npmjs.org/-/package/${name}/dist-tags${ctx.apiUrl}/api/projects${ctx.apiUrl}/api/games/${ctx.projectId}/upload-token${ctx.apiUrl}/api/projects/${ctx.projectId}/push-token${apiUrl}/api/generations${apiUrl}/api/avatars/me

Decision evidence

public snapshot

AI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

package.json bin exposes genex -> dist/index.js; no lifecycle hooks.
dist/index.js writes Genex templates into detected ~/.claude, ~/.codex/skills, ~/.cursor/skills on `genex init`.
dist/index.js auto-refreshes existing genex-* skills on non-init CLI commands via syncSkills().
dist/index.js reads/stores GENEX_TOKEN in ~/.genex/env and sends Bearer auth to Genex API endpoints.
dist/index.js preview/publish can build, collect project files, upload assets, and git push source to server-provided pushUrl.

Evidence against

No preinstall/install/postinstall hook or import-time execution from package.json.
Agent writes are package-owned genex templates and user-invoked CLI behavior, documented in README.md.
Deploy collection excludes node_modules, .git, .genex, dist, .env, and .env.* except .env.example.
Network endpoints are Genex/npm aligned: demo-api.glotech.world, demo-web.glotech.world, registry.npmjs.org, server-returned upload/push/avatar URLs.
No credential harvesting beyond GENEX_TOKEN auth flow; no broad filesystem scanning for secrets found.
No eval/vm/Function or remote code payload execution found.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 20 file(s), 449 KB of source, external domains: 127.0.0.1, demo-api.glotech.world, demo-web.glotech.world, registry.npmjs.org, www.npmjs.com

Source & flagged code

4 flagged

dist/index.jsView file

Lines 1-30javascript

1#!/usr/bin/env node

3// src/commands/init.ts

4import path8 from "path";

6// src/config.ts

7import fs from "fs";

8import os from "os";

9import path from "path";

10import { fileURLToPath } from "url";

11var DEFAULT_AUTH_URL = "https://demo-web.glotech.world";

12var DEFAULT_API_URL = "https://demo-api.glotech.world";

13var DEFAULT_COLYSEUS_URL = "wss://demo-colyseus.glotech.world";

14var ENV_TOKEN_KEY = "GENEX_TOKEN";

15var AUTH_URL_ENV = "GENEX_AUTH_URL";

16var API_URL_ENV = "GENEX_API_URL";

17var COLYSEUS_URL_ENV = "GENEX_COLYSEUS_URL";

18function getAuthUrl(override) {

19 const raw = override || process.env[AUTH_URL_ENV] || DEFAULT_AUTH_URL;

20 return raw.replace(/\/+$/, "");

21}

22function getApiUrl(override) {

23 const raw = override || process.env[API_URL_ENV] || DEFAULT_API_URL;

24 return raw.replace(/\/+$/, "");

25}

26function getColyseusUrl(override) {

27 const raw = override || process.env[COLYSEUS_URL_ENV] || DEFAULT_COLYSEUS_URL;

28 return raw.replace(/\/+$/, "");

29}

30function getGenexDir() {

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/index.jsView on unpkg · L10

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg · L10

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/index.jsView on unpkg · L10

•matchType = previous_version_dangerous_delta matchedPackage = @genex-ai/cli-demo@0.30.0 matchedIdentity = npm:QGdlbmV4LWFpL2NsaS1kZW1v:0.30.0 similarity = 0.950 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg

Source & flagged code

4 flagged · loading source

dist/index.jsView file

10import { fileURLToPath } from "url"; L11: var DEFAULT_AUTH_URL = "https://demo-web.glotech.world"; L12: var DEFAULT_API_URL = "https://demo-api.glotech.world"; ... L18: function getAuthUrl(override) { L19: const raw = override || process.env[AUTH_URL_ENV] || DEFAULT_AUTH_URL; L20: return raw.replace(/\/+$/, ""); ... L30: function getGenexDir() { L31: return path.join(os.homedir(), ".genex"); L32: } ... L43: const here = path.dirname(fileURLToPath(import.meta.url)); L44: const pkg = JSON.parse( L45: fs.readFileSync(path.resolve(here, "..", "package.json"), "utf8")

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/index.jsView on unpkg · L10

10Trigger-reachable chain: manifest.bin -> dist/index.js L10: import { fileURLToPath } from "url"; L11: var DEFAULT_AUTH_URL = "https://demo-web.glotech.world"; L12: var DEFAULT_API_URL = "https://demo-api.glotech.world"; ... L18: function getAuthUrl(override) { L19: const raw = override || process.env[AUTH_URL_ENV] || DEFAULT_AUTH_URL; L20: return raw.replace(/\/+$/, ""); ... L30: function getGenexDir() { L31: return path.join(os.homedir(), ".genex"); L32: } ... L43: const here = path.dirname(fileURLToPath(import.meta.url)); L44: const pkg = JSON.parse( L45: fs.readFileSync(path.resolve(here, "..", "package.json"), "utf8")

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg · L10

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/index.jsView on unpkg · L10

Findings

3 Critical3 Medium5 Low

CriticalCredential Exfiltrationdist/index.js

CriticalTrigger Reachable Dangerous Capabilitydist/index.js

CriticalPrevious Version Dangerous Deltadist/index.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowWeak Cryptodist/index.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

dist/index.jsView file

Lines 1-30javascript

1#!/usr/bin/env node

3// src/commands/init.ts

4import path8 from "path";

6// src/config.ts

7import fs from "fs";

8import os from "os";

9import path from "path";

10import { fileURLToPath } from "url";

11var DEFAULT_AUTH_URL = "https://demo-web.glotech.world";

12var DEFAULT_API_URL = "https://demo-api.glotech.world";

13var DEFAULT_COLYSEUS_URL = "wss://demo-colyseus.glotech.world";

14var ENV_TOKEN_KEY = "GENEX_TOKEN";

15var AUTH_URL_ENV = "GENEX_AUTH_URL";

16var API_URL_ENV = "GENEX_API_URL";

17var COLYSEUS_URL_ENV = "GENEX_COLYSEUS_URL";

18function getAuthUrl(override) {

19 const raw = override || process.env[AUTH_URL_ENV] || DEFAULT_AUTH_URL;

20 return raw.replace(/\/+$/, "");

21}

22function getApiUrl(override) {

23 const raw = override || process.env[API_URL_ENV] || DEFAULT_API_URL;

24 return raw.replace(/\/+$/, "");

25}

26function getColyseusUrl(override) {

27 const raw = override || process.env[COLYSEUS_URL_ENV] || DEFAULT_COLYSEUS_URL;

28 return raw.replace(/\/+$/, "");

29}

30function getGenexDir() {

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/index.jsView on unpkg · L10

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg · L10

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/index.jsView on unpkg · L10

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg