registry / @lmctl-ai/lmctl / 0.1.58

@lmctl-ai/lmctl@0.1.58

A provider-agnostic control plane for teams of AI coding agents — across providers, with independent review and durable memory.

AI Security Review

scanned 8d ago · by lpm-firewall-ai

No confirmed malicious attack surface was established. The risky primitives are CLI features for orchestrating AI coding agents, loading user-selected workflows, diagnostics, and update checks rather than install/import-time behavior.

Static reason

One or more suspicious static signals were detected.

Trigger

User runs lmctl commands such as workflow/run/diagnose/terminal/serve.

Impact

Expected local agent control-plane behavior; no unconsented exfiltration or lifecycle mutation confirmed.

Mechanism

user-invoked CLI orchestration with HTTPS fetch, local SQLite state, diagnostics, and provider process spawning

Rationale

Static inspection shows a legitimate command-line control plane with explicit user-invoked network, shell, workflow, and diagnostic capabilities, but no install-time execution or covert credential/file exfiltration. Scanner findings are explained by package-aligned AI-agent orchestration features.

Evidence

package.jsonbin/lmctldist/cli/index.jsREADME.mdworkflows/qa-suite.compound.jsonworkflows/pr-fix.compound.json

Network endpoints6

registry.npmjs.org/@lmctl-ai/lmctl/latestlmctl.comlmctl.anthropic.comapi.githubcopilot.comapi.deepseek.com/v1openrouter.ai/api/v1

Decision evidence

public snapshot

AI called this Clean at 86.0% confidence as Benign with medium false-positive risk.

Evidence for block

dist/cli/index.js has user-invoked child_process use for provider CLIs, diagnostics, tar/stat, and workflow commands.
dist/cli/index.js fetches HTTPS workflow URLs and npm metadata; remote workflow run/load is CLI-requested and constrained to https.
dist/cli/index.js diagnose can collect local env/status/log metadata, but secret-looking env values are redacted and upload modes are stubs/guarded.

Evidence against

package.json defines bin only and no lifecycle scripts, so no install-time execution found.
bin/lmctl only imports runCli and executes with user CLI arguments.
Network and shell primitives align with an AI-agent orchestration CLI and are behind explicit commands.
Remote workflows require user-supplied https/lmctl URLs and mention a trust prompt for run.
No credential harvesting, persistence, destructive install behavior, or hidden exfiltration path found in inspected source.

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 1 file(s), 794 KB of source, external domains: 127.0.0.1, antigravity.google, api.deepseek.com, api.github.com, api.githubcopilot.com, cli.github.com, docs.anthropic.com, docs.claude.com, docs.github.com, github.com, lmctl.ai, lmctl.anthropic.com, lmctl.com, mailbox.local, nodejs.org, opencode.ai, openrouter.ai, registry.npmjs.org, unpkg.com

Source & flagged code

4 flagged

dist/cli/index.jsView file

High

Child Process

Package source references child process execution.

dist/cli/index.jsView on unpkg · L4

4`).map(e=>Cn(e)).join(` L5: `)}function Jf(t,e){let r=t.toUpperCase();return r.includes("TOKEN")||r.includes("SECRET")||r.includes("KEY")||r.includes("PASSWORD")||r.includes("PASSWD")||r.includes("CREDENTIAL"... L6: `),f=d.slice(Math.max(0,d.length-n));c=f.length,a=Mn(f.join(` ... L16: `)}catch{}}function Kk(){if(!Ys){let e=Gk().slice(0,13).replace("T","-");Ys=zs(nl(),`debug-${e}.log`)}qk(Hk(Ys),{recursive:!0})}function Je(...t){xt({event:"legacy",msg:t.join(" ")... L17: `)){let r=e.trim();if(!r||r.startsWith("#"))continue;if(r.startsWith("["))break;let n=/^debug\s*=\s*(.+)$/.exec(r);if(n){let s=n[1].trim().toLowerCase().replace(/^["']|["']$/g,"");... L18: CREATE TABLE IF NOT EXISTS session_size (

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli/index.jsView on unpkg · L4

1var ck=Object.defineProperty;var b=(t,e)=>()=>(t&&(e=t(t=0)),e);var le=(t,e)=>{for(var r in e)ck(t,r,{get:e[r],enumerable:!0})};import{existsSync as Br,readdirSync as uk,readFileSy... L2: `)}function Qa(){return Nt(gr(),_k)}function Wf(){return Nt(gr(),gk)}function wk(){try{return Br(Qa())}catch{return!1}}function Bf(t=process.stderr){wk()&&t.write(`note: legacy ~/.... L3: `)}var mk,Pf,pk,hk,Ff,_k,gk,wr,Ye=b(()=>{"use strict";mk=".lmctl",Pf="state.db",pk="workspaces",hk="active-workspace",Ff="default",_k="profiles",gk="active-profile";wr={default:Ff}... L4: `).map(e=>Cn(e)).join(` L5: `)}function Jf(t,e){let r=t.toUpperCase();return r.includes("TOKEN")||r.includes("SECRET")||r.includes("KEY")||r.includes("PASSWORD")||r.includes("PASSWD")||r.includes("CREDENTIAL"... L6: `),f=d.slice(Math.max(0,d.length-n));c=f.length,a=Mn(f.join(` ... L16: `)}catch{}}function Kk(){if(!Ys){let e=Gk().slice(0,13).replace("T","-");Ys=zs(nl(),`debug-${e}.log`)}qk(Hk(Ys),{recursive:!0})}function Je(...t){xt({event:"legacy",msg:t.join(" ")... L17: `)){let r=e.trim();if(!r||r.startsWith("#"))continue;if(r.startsWith("["))break;let n=/^debug\s*=\s*(.+)$/.exec(r);if(n){let s=n[1].trim().toLowerCase().rep

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/cli/index.jsView on unpkg · L1

1var ck=Object.defineProperty;var b=(t,e)=>()=>(t&&(e=t(t=0)),e);var le=(t,e)=>{for(var r in e)ck(t,r,{get:e[r],enumerable:!0})};import{existsSync as Br,readdirSync as uk,readFileSy... L2: `)}function Qa(){return Nt(gr(),_k)}function Wf(){return Nt(gr(),gk)}function wk(){try{return Br(Qa())}catch{return!1}}function Bf(t=process.stderr){wk()&&t.write(`note: legacy ~/.... ... L4: `).map(e=>Cn(e)).join(` L5: `)}function Jf(t,e){let r=t.toUpperCase();return r.includes("TOKEN")||r.includes("SECRET")||r.includes("KEY")||r.includes("PASSWORD")||r.includes("PASSWD")||r.includes("CREDENTIAL"... L6: `),f=d.slice(Math.max(0,d.length-n));c=f.length,a=Mn(f.join(` ... L14: `).filter(i=>i.length>0),o=s.slice(Math.max(0,s.length-r));return{source_path:e,tail_lines:o.length,tail:Mn(o.join(` L15: `)),note:null}}catch(n){return n.code==="ENOENT"?{source_path:e,tail_lines:0,tail:"",note:"no intent log present (status never run on this host)"}:{source_path:e,tail_lines:0,tail:... L16: `)}catch{}}function Kk(){if(!Ys){let e=Gk().slice(0,13).replace("T","-");Ys=zs(nl(),`debug-${e}.log`)}qk(Hk(Ys),{recursive:!0})}function Je(...t){xt({event:"legacy",msg:t.join(" ")... L17: `)){let r=e.trim();if(!r||r.s

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/cli/index.jsView on unpkg · L1

Source & flagged code

4 flagged · loading source

dist/cli/index.jsView file

High

Child Process

Package source references child process execution.

dist/cli/index.jsView on unpkg · L4

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli/index.jsView on unpkg · L4

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/cli/index.jsView on unpkg · L1

1var ck=Object.defineProperty;var b=(t,e)=>()=>(t&&(e=t(t=0)),e);var le=(t,e)=>{for(var r in e)ck(t,r,{get:e[r],enumerable:!0})};import{existsSync as Br,readdirSync as uk,readFileSy... L2: `)}function Qa(){return Nt(gr(),_k)}function Wf(){return Nt(gr(),gk)}function wk(){try{return Br(Qa())}catch{return!1}}function Bf(t=process.stderr){wk()&&t.write(`note: legacy ~/.... ... L4: `).map(e=>Cn(e)).join(` L5: `)}function Jf(t,e){let r=t.toUpperCase();return r.includes("TOKEN")||r.includes("SECRET")||r.includes("KEY")||r.includes("PASSWORD")||r.includes("PASSWD")||r.includes("CREDENTIAL"... L6: `),f=d.slice(Math.max(0,d.length-n));c=f.length,a=Mn(f.join(` ... L14: `).filter(i=>i.length>0),o=s.slice(Math.max(0,s.length-r));return{source_path:e,tail_lines:o.length,tail:Mn(o.join(` L15: `)),note:null}}catch(n){return n.code==="ENOENT"?{source_path:e,tail_lines:0,tail:"",note:"no intent log present (status never run on this host)"}:{source_path:e,tail_lines:0,tail:... L16: `)}catch{}}function Kk(){if(!Ys){let e=Gk().slice(0,13).replace("T","-");Ys=zs(nl(),`debug-${e}.log`)}qk(Hk(Ys),{recursive:!0})}function Je(...t){xt({event:"legacy",msg:t.join(" ")... L17: `)){let r=e.trim();if(!r||r.s

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/cli/index.jsView on unpkg · L1

Findings

4 High2 Medium5 Low

HighChild Processdist/cli/index.js

HighShell

HighSame File Env Network Executiondist/cli/index.js

HighCommand Output Exfiltrationdist/cli/index.js

MediumNetwork

MediumEnvironment Vars

LowWeak Cryptodist/cli/index.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

4 flagged

dist/cli/index.jsView file

High

Child Process

Package source references child process execution.

dist/cli/index.jsView on unpkg · L4

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli/index.jsView on unpkg · L4

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/cli/index.jsView on unpkg · L1

1var ck=Object.defineProperty;var b=(t,e)=>()=>(t&&(e=t(t=0)),e);var le=(t,e)=>{for(var r in e)ck(t,r,{get:e[r],enumerable:!0})};import{existsSync as Br,readdirSync as uk,readFileSy... L2: `)}function Qa(){return Nt(gr(),_k)}function Wf(){return Nt(gr(),gk)}function wk(){try{return Br(Qa())}catch{return!1}}function Bf(t=process.stderr){wk()&&t.write(`note: legacy ~/.... ... L4: `).map(e=>Cn(e)).join(` L5: `)}function Jf(t,e){let r=t.toUpperCase();return r.includes("TOKEN")||r.includes("SECRET")||r.includes("KEY")||r.includes("PASSWORD")||r.includes("PASSWD")||r.includes("CREDENTIAL"... L6: `),f=d.slice(Math.max(0,d.length-n));c=f.length,a=Mn(f.join(` ... L14: `).filter(i=>i.length>0),o=s.slice(Math.max(0,s.length-r));return{source_path:e,tail_lines:o.length,tail:Mn(o.join(` L15: `)),note:null}}catch(n){return n.code==="ENOENT"?{source_path:e,tail_lines:0,tail:"",note:"no intent log present (status never run on this host)"}:{source_path:e,tail_lines:0,tail:... L16: `)}catch{}}function Kk(){if(!Ys){let e=Gk().slice(0,13).replace("T","-");Ys=zs(nl(),`debug-${e}.log`)}qk(Hk(Ys),{recursive:!0})}function Je(...t){xt({event:"legacy",msg:t.join(" ")... L17: `)){let r=e.trim();if(!r||r.s

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/cli/index.jsView on unpkg · L1