@ghl-ai/aw@0.2.0
Agentic Workspace CLI — pull, push & manage agents, skills and commands from the registry
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe package’s usage hooks send identifying details, including Git identity and a stable machine identifier, to the vendor by default after setup. This is telemetry with identifying details, so it warrants a warning even though prompt text is not sent and opt-out controls exist.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
After a user runs AW setup that installs the hooks, agent activity triggers telemetry events automatically.
Impact
The vendor receives identifying and project-linked usage metadata without a clear opt-in; users can disable collection through environment variables or configuration.
Mechanism
Hooks build event payloads containing Git identity, optional IDE account email, a hashed project path, and a stable machine identifier, then send them asynchronously over HTTPS.
AI rationale
The package’s usage hooks send identifying details, including Git identity and a stable machine identifier, to the vendor by default after setup. This is telemetry with identifying details, so it warrants a warning even though prompt text is not sent and opt-out controls exist.
Evidence
hooks/aw-usage/lib/aw-usage-telemetry.jshooks/aw-usage/hooks/aw-usage-telemetry-send.jsaw-usage-wiring.mjs~/.aw/telemetry/config.json
Network endpoints1
services.leadconnectorhq.com/agentic-workspace/api/telemetry/usage-events
Decision evidence
public snapshotAI called this Suspicious at 92.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Usage events include Git user name and email, an IDE account email when available, and a project hash.
- The machine ID is a stable hash derived from the hostname and OS username.
- AW installs asynchronous telemetry hooks into agent settings; telemetry is enabled by default when its config is absent.
- The sender posts events to the vendor’s telemetry endpoint.
Evidence against
- The prompt hook says it sends a boundary marker and AW command names, not prompt text.
- Telemetry can be disabled with DO_NOT_TRACK=1, AW_TELEMETRY_DISABLED=1, or config enabled=false.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
12 flaggedmcp.mjsView file
4import { existsSync, writeFileSync, readFileSync, mkdirSync, renameSync } from 'node:fs';
L5: import { execSync } from 'node:child_process';
L6: import { createInterface } from 'node:readline';
High
4import { existsSync, writeFileSync, readFileSync, mkdirSync, renameSync } from 'node:fs';
L5: import { execSync } from 'node:child_process';
L6: import { createInterface } from 'node:readline';
...
L12:
L13: const HOME = homedir();
L14: export const DEFAULT_MCP_URL = 'https://services.leadconnectorhq.com/agentic-workspace/mcp';
L15: const MCP_PREFS_FILENAME = 'mcp-preferences.json';
...
L28: try {
L29: return JSON.parse(readFileSync(filePath, 'utf8'));
L30: } catch {
...
L43:
L44: function envDisablesMcp(env = process.env) {
High
Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
mcp.mjsView on unpkg · L4integrations.mjsView file
27L28: const execAsync = promisify(exec);
L29: const HOME = homedir();
Findings
3 Critical6 High6 Medium5 Low
CriticalDownload Executeintegrations.mjs#virtual:normalized:round1
CriticalTrigger Reachable Dangerous Capabilityintegrations.mjs#virtual:normalized:round1
CriticalPrevious Version Dangerous Deltahooks.mjs
HighChild Processmcp.mjs
HighShellintegrations.mjs
HighSandbox Evasion Gated Capabilitymcp.mjs
HighTrigger Reachable External Ai Agent Control Surface Mutationstartup.mjs
HighTrigger Reachable Persistencecommands/daemon.mjs
HighSemantic Analysis Limitedc4/initRepo.mjs#virtual:normalized:round1
MediumDynamic Requirecommands/init.mjs
MediumNetwork
Medium
Affected versions and remediation
This report applies to @ghl-ai/aw@0.2.0.
See all versions of @ghl-ai/aw for other recorded verdicts.
- Review the evidence and your use of @ghl-ai/aw@0.2.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.