registry / @holt-os/holt / 0.8.0

@holt-os/holt@0.8.0

An open-source personal agent OS: any LLM, private memory you can see and walk.

AI Security Review

scanned 6d ago · by lpm-firewall-ai

No confirmed malicious attack surface: risky primitives are documented, package-aligned, and user-invoked. There is no install-time execution, credential harvesting, hidden exfiltration, or unconsented AI-agent control-surface mutation.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Explicit CLI commands such as holt init, run, schedule, telegram, notify, mcp, or skill add.

Impact

User-requested agent output may be sent to configured providers or Telegram; scheduled jobs persist only after explicit schedule add.

Mechanism

documented personal agent CLI with memory, optional API/Telegram/MCP integrations, and optional schedulers

Rationale

Static inspection found a documented CLI agent OS with sensitive capabilities gated by explicit commands and prompts, not npm lifecycle/import execution. Scanner exfiltration/persistence hints map to user-invoked Telegram notification, scheduling, and alias features rather than covert behavior.

Evidence

package.jsondist/cli.jsREADME.md~/.holt/trust.json~/.holt/credentials.json~/.holt/telegram.json~/.holt/schedules.json~/.holt/logs/<id>.log~/.zshrc~/.bashrc~/.profile~/Library/LaunchAgents/com.holt.<id>.plist./.holt/config.json./.holt/memory/turns.jsonl./.holt/memory/facts.md./.holt/skills/<name>/SKILL.md

Network endpoints7

127.0.0.1:11434/api/tags127.0.0.1:11434/api/embeddingsapi.anthropic.com/v1/messagesapi.openai.com/v1/chat/completionsgenerativelanguage.googleapis.com/v1beta/models/<model>:streamGenerateContent?alt=sseapi.telegram.org/bot<token>/sendMessageapi.telegram.org/bot<token>/getUpdates

Decision evidence

public snapshot

AI called this Clean at 88.0% confidence as Benign with low false-positive risk.

Evidence for block

Evidence against

package.json has no npm lifecycle hooks; only bin holt -> dist/cli.js.
dist/cli.js writes ~/.holt credentials, trust, schedules, telegram config, and workspace .holt files only from user-invoked commands.
Telegram send/getUpdates are activated by holt telegram/setup/notify and restricted to configured allowedChatId.
Shell/profile alias and launchd/cron persistence are explicit user commands: init alias prompt or schedule add.
Brain CLI spawning and npm global installs occur during interactive init/login/run workflows, not install/import time.
README.md documents MCP, Telegram, scheduling, credentials, and storage behavior.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 129 KB of source, external domains: 127.0.0.1, api.anthropic.com, api.openai.com, api.telegram.org, generativelanguage.googleapis.com, github.com, ollama.com, productsdecoded.com, www.apple.com

Source & flagged code

4 flagged

dist/cli.jsView file

Lines 1-33javascript

1#!/usr/bin/env node

3// src/config.ts

4import { readFileSync as readFileSync2, writeFileSync as writeFileSync2, existsSync as existsSync2, mkdirSync as mkdirSync2 } from "fs";

5import { join as join2 } from "path";

7// src/workspace.ts

8import { homedir } from "os";

9import { join } from "path";

10import { mkdirSync, readFileSync, writeFileSync } from "fs";

12// src/ui.ts

13import readline from "readline";

14var on = process.stdout.isTTY && !process.env.NO_COLOR;

15var wrap = (code) => (s) => on ? `\x1B[${code}m${s}\x1B[0m` : s;

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

dist/cli.jsView on unpkg · L13

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/cli.jsView on unpkg · L13

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

16var c = {

17 dim: wrap("2"),

18 bold: wrap("1"),

19 accent: wrap("38;5;214"),

20 // amber

21 green: wrap("32"),

22 red: wrap("31"),

23 cyan: wrap("36")

24};

25function createReader() {

26 const rl = readline.createInterface({ input: process.stdin, output: process.stdout });

27 const buffer = [];

28 const waiters = [];

29 let closed = false;

30 rl.on("line", (line) => {

31 const w = waiters.shift();

32 if (w) w(line);

33 else buffer.push(line);

Lines 174-214javascript

174function resolveApiKey(brain) {

175 if (brain.keyEnv) {

176 const v = process.env[brain.keyEnv];

177 if (v && v.trim()) return v.trim();

178 }

179 const creds = readCredentials

Source & flagged code

4 flagged · loading source

dist/cli.jsView file

13import readline from "readline"; L14: var on = process.stdout.isTTY && !process.env.NO_COLOR; L15: var wrap = (code) => (s) => on ? `\x1B[${code}m${s}\x1B[0m` : s; ... L38: }); L39: const ask = (q) => new Promise((resolve4) => { L40: if (q) process.stdout.write(q); L41: if (buffer.length) resolve4(buffer.shift()); ... L48: // src/workspace.ts L49: var GLOBAL_DIR = join(homedir(), ".holt"); L50: var TRUST_PATH = join(GLOBAL_DIR, "trust.json"); ... L61: try { L62: return JSON.parse(readFileSync(TRUST_PATH, "utf8"));

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

dist/cli.jsView on unpkg · L13

13Trigger-reachable chain: manifest.bin -> dist/cli.js L13: import readline from "readline"; L14: var on = process.stdout.isTTY && !process.env.NO_COLOR; L15: var wrap = (code) => (s) => on ? `\x1B[${code}m${s}\x1B[0m` : s; ... L38: }); L39: const ask = (q) => new Promise((resolve4) => { L40: if (q) process.stdout.write(q); L41: if (buffer.length) resolve4(buffer.shift()); ... L48: // src/workspace.ts L49: var GLOBAL_DIR = join(homedir(), ".holt"); L50: var TRUST_PATH = join(GLOBAL_DIR, "trust.json"); ... L61: try { L62: return JSON.parse(readFileSync(TRUST_PATH, "utf8"));

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/cli.jsView on unpkg · L13

194// src/brains.ts L195: import { spawn, spawnSync } from "child_process"; L196: var MAX_REPLAY_TURNS = 12;

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L194

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/cli.jsView on unpkg · L13

Findings

2 Critical2 High4 Medium4 Low

CriticalCommand Output Exfiltrationdist/cli.js

CriticalTrigger Reachable Dangerous Capabilitydist/cli.js

HighChild Processdist/cli.js

HighShell

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/cli.js

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

dist/cli.jsView file

Lines 1-33javascript

1#!/usr/bin/env node

3// src/config.ts

4import { readFileSync as readFileSync2, writeFileSync as writeFileSync2, existsSync as existsSync2, mkdirSync as mkdirSync2 } from "fs";

5import { join as join2 } from "path";

7// src/workspace.ts

8import { homedir } from "os";

9import { join } from "path";

10import { mkdirSync, readFileSync, writeFileSync } from "fs";

12// src/ui.ts

13import readline from "readline";

14var on = process.stdout.isTTY && !process.env.NO_COLOR;

15var wrap = (code) => (s) => on ? `\x1B[${code}m${s}\x1B[0m` : s;

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

dist/cli.jsView on unpkg · L13

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/cli.jsView on unpkg · L13

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

16var c = {

17 dim: wrap("2"),

18 bold: wrap("1"),

19 accent: wrap("38;5;214"),

20 // amber

21 green: wrap("32"),

22 red: wrap("31"),

23 cyan: wrap("36")

24};

25function createReader() {

26 const rl = readline.createInterface({ input: process.stdin, output: process.stdout });

27 const buffer = [];

28 const waiters = [];

29 let closed = false;

30 rl.on("line", (line) => {

31 const w = waiters.shift();

32 if (w) w(line);

33 else buffer.push(line);

Lines 174-214javascript

174function resolveApiKey(brain) {

175 if (brain.keyEnv) {

176 const v = process.env[brain.keyEnv];

177 if (v && v.trim()) return v.trim();

178 }

179 const creds = readCredentials