@ghl-ai/aw@0.1.92
Agentic Workspace CLI — pull, push & manage agents, skills and commands from the registry
AI Security Review
scanned 2mo ago · by lpm-firewall-aiScanner download-and-execute and agent-hook findings are the CLI’s own init and integration paths, not an install-time backdoor. The remaining warn is the silent preuninstall nuke plus dual-use remote installers and agent-surface writes that run only after the user invokes the CLI.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
npm uninstall (preuninstall), or a user running aw init, aw integrations add, or aw daemon install.
Impact
AW-managed agent hooks and local registry state are removed or rewritten; opted-in init can execute third-party install scripts and schedule silent pulls.
Mechanism
Uninstall-time agent-config cleanup plus user-invoked remote installer and IDE hook writes
AI rationale
Scanner download-and-execute and agent-hook findings are the CLI’s own init and integration paths, not an install-time backdoor. The remaining warn is the silent preuninstall nuke plus dual-use remote installers and agent-surface writes that run only after the user invokes the CLI.
Evidence
package.jsoncommands/nuke.mjsstartup.mjsintegrations.mjscommands/daemon.mjs~/.claude/settings.json~/.codex/config.toml~/.codex/hooks.json~/.cursor/hooks.json~/Library/LaunchAgents/ai.ghl.aw.pull.plist~/.aw~/.aw_registry
Network endpoints4
raw.githubusercontent.com/rtk-ai/rtk/refs/heads/master/install.shleanctx.com/install.shservices.leadconnectorhq.com/agentic-workspace/api/telemetry/eventsgithub.com/GoHighLevel/platform-docs.git
Decision evidence
public snapshotAI called this Suspicious at 84.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- npm preuninstall silently runs `aw nuke`, which strips Claude, Cursor, and Codex hooks plus AW home dirs with no prompt.
- `aw init` writes session-router and telemetry hooks into Claude, Cursor, and Codex settings.
- Universal installers curl a remote install.sh and pipe it to bash, including RTK from GitHub raw, then patch agent IDEs.
- `aw daemon install` drops a launchd or cron job that silently runs `aw pull`.
- Telemetry is on by default and posts git user.name and user.email to the GoHighLevel LeadConnector API.
Evidence against
- No preinstall, install, or postinstall scripts; the published bin is a user-invoked CLI.
- Behavior matches the stated Agentic Workspace product: registry pull/push, IDE wiring, and optional third-party integrations.
- Remote hosts are vendor or named-tool URLs (GoHighLevel GitHub, LeadConnector, ClickUp, leanctx, rtk-ai), not a hidden C2.
- Nuke and hook writes target AW-managed markers; telemetry has env and CLI opt-out.
Behavioral surface
ChildProcessCrypto
Source & flagged code
12 flaggedmcp.mjsView file
4import { existsSync, writeFileSync, readFileSync, mkdirSync, renameSync } from 'node:fs';
L5: import { execSync } from 'node:child_process';
L6: import { createInterface } from 'node:readline';
High
4import { existsSync, writeFileSync, readFileSync, mkdirSync, renameSync } from 'node:fs';
L5: import { execSync } from 'node:child_process';
L6: import { createInterface } from 'node:readline';
...
L12:
L13: const HOME = homedir();
L14: export const DEFAULT_MCP_URL = 'https://services.leadconnectorhq.com/agentic-workspace/mcp';
L15: const MCP_PREFS_FILENAME = 'mcp-preferences.json';
...
L28: try {
L29: return JSON.parse(readFileSync(filePath, 'utf8'));
L30: } catch {
...
L43:
L44: function envDisablesMcp(env = process.env) {
High
Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
mcp.mjsView on unpkg · L4integrations.mjsView file
•
Findings
3 Critical6 High6 Medium5 Low
CriticalDownload Executeintegrations.mjs#virtual:normalized:round1
CriticalTrigger Reachable Dangerous Capabilityintegrations.mjs#virtual:normalized:round1
CriticalPrevious Version Dangerous Deltaintegrations.mjs
HighChild Processmcp.mjs
HighShellintegrations.mjs
HighSandbox Evasion Gated Capabilitymcp.mjs
HighTrigger Reachable External Ai Agent Control Surface Mutationstartup.mjs
HighTrigger Reachable Persistencecommands/daemon.mjs
HighSemantic Analysis Limitedc4/initRepo.mjs#virtual:normalized:round1
MediumDynamic Requirecommands/init.mjs
MediumNetwork
Medium
Affected versions and remediation
This report applies to @ghl-ai/aw@0.1.92.
See all versions of @ghl-ai/aw for other recorded verdicts.
- Review the evidence and your use of @ghl-ai/aw@0.1.92 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.