registry  /  @lmctl-ai/lmctl  /  0.1.60

@lmctl-ai/lmctl@0.1.60

A provider-agnostic control plane for teams of AI coding agents — across providers, with independent review and durable memory.

AI Security Review

scanned 8d ago · by lpm-firewall-ai

No confirmed malicious attack surface. The package is a CLI control plane for AI coding agents; risky primitives are exposed through explicit lmctl commands and bundled workflows rather than install-time or import-time behavior.

Static reason
One or more suspicious static signals were detected.
Trigger
User runs lmctl commands such as serve, api, workflow run/load, diagnose, device, seed, terminal, or bundled workflows.
Impact
Expected command execution and network/file access within the tool's stated agent-control workflows; no unconsented malicious impact identified.
Mechanism
User-invoked CLI orchestration with subprocesses, local SQLite/state files, optional HTTPS/API access, and workflow execution.
Rationale
Static inspection confirms a powerful agent orchestration CLI, but the suspicious primitives are documented, user-invoked, and aligned with package purpose, with no lifecycle execution or covert exfiltration path found. Mark clean despite scanner hits on network/env/child_process.
Evidence
package.jsonbin/lmctldist/cli/index.jsREADME.mdworkflows/pr-fix.compound.jsonworkflows/qa-suite.compound.jsonworkflows/triage-v2.compound.json
Network endpoints7
registry.npmjs.org/@lmctl-ai/lmctl/latestlmctl.comlmctl.anthropic.com127.0.0.1:8787api.githubcopilot.comapi.deepseek.com/v1openrouter.ai/api/v1

Decision evidence

public snapshot
AI called this Clean at 88.0% confidence as Benign with low false-positive risk.
Evidence for block
  • dist/cli/index.js contains user-invoked child_process use for provider CLIs, diagnostics, tar/stat, and workflow helpers.
  • dist/cli/index.js supports remote https workflow/skill loading and API/device network operations.
  • workflows/*.compound.json include command steps that can run git/node/lmctl in user projects when workflows are run.
Evidence against
  • package.json has no install/preinstall/postinstall lifecycle scripts.
  • bin/lmctl only imports dist/cli/index.js and calls runCli with user CLI args.
  • Network paths are command-gated and package-aligned: update notifier, API client/server, workflow URL loading, device mailbox, diagnostics stubs.
  • Diagnostic collection redacts token/secret env names and sanitizes bundles unless explicitly disabled; uploads are stubbed for HQ/internal S3.
  • No import-time credential harvesting, persistence, destructive behavior, or unsolicited exfiltration found.
Behavioral surface
Source
ChildProcessEnvironmentVarsFilesystemNetworkShell
Supply chain
HighEntropyStringsUrlStrings
Manifest
NoLicense
scanned 1 file(s), 796 KB of source, external domains: 127.0.0.1, antigravity.google, api.deepseek.com, api.github.com, api.githubcopilot.com, cli.github.com, docs.anthropic.com, docs.claude.com, docs.github.com, github.com, lmctl.ai, lmctl.anthropic.com, lmctl.com, mailbox.local, nodejs.org, opencode.ai, openrouter.ai, registry.npmjs.org, unpkg.com

Source & flagged code

4 flagged · loading source
dist/cli/index.jsView file
4`).map(e=>Mn(e)).join(` L5: `)}function Xf(t,e){let r=t.toUpperCase();return r.includes("TOKEN")||r.includes("SECRET")||r.includes("KEY")||r.includes("PASSWORD")||r.includes("PASSWD")||r.includes("CREDENTIAL"... L6: `),f=d.slice(Math.max(0,d.length-n));c=f.length,a=Dn(f.join(`
High
Child Process

Package source references child process execution.

dist/cli/index.jsView on unpkg · L4
4`).map(e=>Mn(e)).join(` L5: `)}function Xf(t,e){let r=t.toUpperCase();return r.includes("TOKEN")||r.includes("SECRET")||r.includes("KEY")||r.includes("PASSWORD")||r.includes("PASSWD")||r.includes("CREDENTIAL"... L6: `),f=d.slice(Math.max(0,d.length-n));c=f.length,a=Dn(f.join(` ... L16: `)}catch{}}function Vk(){if(!zs){let e=Kk().slice(0,13).replace("T","-");zs=Zs(sl(),`debug-${e}.log`)}Hk(Jk(zs),{recursive:!0})}function Je(...t){jt({event:"legacy",msg:t.join(" ")... L17: `)){let r=e.trim();if(!r||r.startsWith("#"))continue;if(r.startsWith("["))break;let n=/^debug\s*=\s*(.+)$/.exec(r);if(n){let s=n[1].trim().toLowerCase().replace(/^["']|["']$/g,"");... L18: CREATE TABLE IF NOT EXISTS session_size (
High
Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli/index.jsView on unpkg · L4
1var uk=Object.defineProperty;var b=(t,e)=>()=>(t&&(e=t(t=0)),e);var le=(t,e)=>{for(var r in e)uk(t,r,{get:e[r],enumerable:!0})};import{existsSync as qr,readdirSync as dk,readFileSy... L2: `)}function el(){return $t(gr(),gk)}function Bf(){return $t(gr(),wk)}function Ek(){try{return qr(el())}catch{return!1}}function qf(t=process.stderr){Ek()&&t.write(`note: legacy ~/.... L3: `)}var pk,Ff,hk,_k,Uf,gk,wk,yr,Ye=b(()=>{"use strict";pk=".lmctl",Ff="state.db",hk="workspaces",_k="active-workspace",Uf="default",gk="profiles",wk="active-profile";yr={default:Uf}... L4: `).map(e=>Mn(e)).join(` L5: `)}function Xf(t,e){let r=t.toUpperCase();return r.includes("TOKEN")||r.includes("SECRET")||r.includes("KEY")||r.includes("PASSWORD")||r.includes("PASSWD")||r.includes("CREDENTIAL"... L6: `),f=d.slice(Math.max(0,d.length-n));c=f.length,a=Dn(f.join(` ... L16: `)}catch{}}function Vk(){if(!zs){let e=Kk().slice(0,13).replace("T","-");zs=Zs(sl(),`debug-${e}.log`)}Hk(Jk(zs),{recursive:!0})}function Je(...t){jt({event:"legacy",msg:t.join(" ")... L17: `)){let r=e.trim();if(!r||r.startsWith("#"))continue;if(r.startsWith("["))break;let n=/^debug\s*=\s*(.+)$/.exec(r);if(n){let s=n[1].trim().toLowerCase().rep
High
Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/cli/index.jsView on unpkg · L1
1var uk=Object.defineProperty;var b=(t,e)=>()=>(t&&(e=t(t=0)),e);var le=(t,e)=>{for(var r in e)uk(t,r,{get:e[r],enumerable:!0})};import{existsSync as qr,readdirSync as dk,readFileSy... L2: `)}function el(){return $t(gr(),gk)}function Bf(){return $t(gr(),wk)}function Ek(){try{return qr(el())}catch{return!1}}function qf(t=process.stderr){Ek()&&t.write(`note: legacy ~/.... ... L4: `).map(e=>Mn(e)).join(` L5: `)}function Xf(t,e){let r=t.toUpperCase();return r.includes("TOKEN")||r.includes("SECRET")||r.includes("KEY")||r.includes("PASSWORD")||r.includes("PASSWD")||r.includes("CREDENTIAL"... L6: `),f=d.slice(Math.max(0,d.length-n));c=f.length,a=Dn(f.join(` ... L14: `).filter(i=>i.length>0),o=s.slice(Math.max(0,s.length-r));return{source_path:e,tail_lines:o.length,tail:Dn(o.join(` L15: `)),note:null}}catch(n){return n.code==="ENOENT"?{source_path:e,tail_lines:0,tail:"",note:"no intent log present (status never run on this host)"}:{source_path:e,tail_lines:0,tail:... L16: `)}catch{}}function Vk(){if(!zs){let e=Kk().slice(0,13).replace("T","-");zs=Zs(sl(),`debug-${e}.log`)}Hk(Jk(zs),{recursive:!0})}function Je(...t){jt({event:"legacy",msg:t.join(" ")... L17: `)){let r=e.trim();if(!r||r.s
Low
Weak Crypto

Package source references weak cryptographic algorithms.

dist/cli/index.jsView on unpkg · L1

Findings

4 High2 Medium5 Low
HighChild Processdist/cli/index.js
HighShell
HighSame File Env Network Executiondist/cli/index.js
HighCommand Output Exfiltrationdist/cli/index.js
MediumNetwork
MediumEnvironment Vars
LowWeak Cryptodist/cli/index.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License