registry / @lmctl-ai/lmctl / 0.1.92

@lmctl-ai/lmctl@0.1.92

A provider-agnostic control plane for teams of AI coding agents — across providers, with independent review and durable memory.

AI Security Review

scanned 2d ago · by lpm-firewall-ai

No confirmed malicious attack surface was found. Risky primitives are package-aligned CLI capabilities and require explicit user commands, not npm install/import execution.

Static reason

One or more suspicious static signals were detected.

Trigger

User runs lmctl CLI subcommands.

Impact

No unauthorized exfiltration or install-time control-surface mutation identified.

Mechanism

User-invoked agent orchestration, local state management, optional API/workflow network calls.

Rationale

Static source inspection shows a feature-rich AI-agent CLI with expected child_process, env, filesystem, and network usage, but no lifecycle hooks or unconsented execution path. The suspicious signals are package-aligned and user-invoked, so this is not malicious.

Evidence

package.jsonbin/lmctldist/cli/index.jsREADME.md

Network endpoints4

registry.npmjs.org/@lmctl-ai/lmctl/latestlmctl.comlmctl.anthropic.comcognito-idp.<region>.amazonaws.com/

Decision evidence

public snapshot

AI called this Clean at 88.0% confidence as Benign with low false-positive risk.

Evidence for block

dist/cli/index.js can spawn provider CLIs and includes bypass/yolo flags for codex/claude/gemini/qwen/agy.
dist/cli/index.js has user-invoked API, workflow URL fetch, update check, and diagnostic bundle code.
dist/cli/index.js reads env vars such as LMCTL_API_TOKEN and can read session/db/log paths for status/diagnostics.

Evidence against

package.json has no lifecycle scripts; bin only points to bin/lmctl.
bin/lmctl only imports runCli and passes argv; no install-time mutation.
Network and shell execution are CLI subcommands aligned with an AI-agent control-plane package.
Diagnostics redact token/secret/password/key fields and upload modes are stubbed or explicit.
Remote workflow fetch requires https and is invoked by workflow load/run commands.
No evidence of credential harvesting, stealth persistence, destructive install behavior, or unconsented AI-agent config writes.

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 1 file(s), 827 KB of source, external domains: 127.0.0.1, antigravity.google, api.github.com, cli.github.com, docs.anthropic.com, docs.claude.com, docs.github.com, github.com, lmctl.ai, lmctl.anthropic.com, lmctl.com, mailbox.local, nodejs.org, opencode.ai, registry.npmjs.org, unpkg.com

Source & flagged code

4 flagged

dist/cli/index.jsView file

High

Child Process

Package source references child process execution.

dist/cli/index.jsView on unpkg · L4

4`).map(e=>Xn(e)).join(` L5: `)}function cm(t,e){let r=t.toUpperCase();return r.includes("TOKEN")||r.includes("SECRET")||r.includes("KEY")||r.includes("PASSWORD")||r.includes("PASSWD")||r.includes("CREDENTIAL"... L6: `),f=d.slice(Math.max(0,d.length-n));c=f.length,a=Gn(f.join(` ... L16: `)}catch{}}function Bv(){if(!mo){let e=Wv().slice(0,13).replace("T","-");mo=po(gl(),`debug-${e}.log`)}Dv(Pv(mo),{recursive:!0})}function Fe(...t){ut({event:"legacy",msg:t.join(" ")... L17: `)){let r=e.trim();if(!r||r.startsWith("#"))continue;if(r.startsWith("["))break;let n=/^debug\s*=\s*(.+)$/.exec(r);if(n){let s=n[1].trim().toLowerCase().replace(/^["']|["']$/g,"");... L18: CREATE TABLE IF NOT EXISTS session_size (

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli/index.jsView on unpkg · L4

1var nv=Object.defineProperty;var E=(t,e)=>()=>(t&&(e=t(t=0)),e);var re=(t,e)=>{for(var r in e)nv(t,r,{get:e[r],enumerable:!0})};import{existsSync as Kr,readdirSync as sv,readFileSy... L2: `)}function ml(){return Mt(kr(),uv)}function om(){return Mt(kr(),dv)}function mv(){try{return Kr(ml())}catch{return!1}}function im(t=process.stderr){mv()&&t.write(`note: legacy ~/.... L3: `)}var av,rm,lv,cv,nm,uv,dv,Ir,Ve=E(()=>{"use strict";av=".lmctl",rm="state.db",lv="workspaces",cv="active-workspace",nm="default",uv="profiles",dv="active-profile";Ir={default:nm}... L4: `).map(e=>Xn(e)).join(` L5: `)}function cm(t,e){let r=t.toUpperCase();return r.includes("TOKEN")||r.includes("SECRET")||r.includes("KEY")||r.includes("PASSWORD")||r.includes("PASSWD")||r.includes("CREDENTIAL"... L6: `),f=d.slice(Math.max(0,d.length-n));c=f.length,a=Gn(f.join(` ... L16: `)}catch{}}function Bv(){if(!mo){let e=Wv().slice(0,13).replace("T","-");mo=po(gl(),`debug-${e}.log`)}Dv(Pv(mo),{recursive:!0})}function Fe(...t){ut({event:"legacy",msg:t.join(" ")... L17: `)){let r=e.trim();if(!r||r.startsWith("#"))continue;if(r.startsWith("["))break;let n=/^debug\s*=\s*(.+)$/.exec(r);if(n){let s=n[1].trim().toLowerCase().rep

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/cli/index.jsView on unpkg · L1

1var nv=Object.defineProperty;var E=(t,e)=>()=>(t&&(e=t(t=0)),e);var re=(t,e)=>{for(var r in e)nv(t,r,{get:e[r],enumerable:!0})};import{existsSync as Kr,readdirSync as sv,readFileSy... L2: `)}function ml(){return Mt(kr(),uv)}function om(){return Mt(kr(),dv)}function mv(){try{return Kr(ml())}catch{return!1}}function im(t=process.stderr){mv()&&t.write(`note: legacy ~/.... ... L4: `).map(e=>Xn(e)).join(` L5: `)}function cm(t,e){let r=t.toUpperCase();return r.includes("TOKEN")||r.includes("SECRET")||r.includes("KEY")||r.includes("PASSWORD")||r.includes("PASSWD")||r.includes("CREDENTIAL"... L6: `),f=d.slice(Math.max(0,d.length-n));c=f.length,a=Gn(f.join(` ... L14: `).filter(i=>i.length>0),o=s.slice(Math.max(0,s.length-r));return{source_path:e,tail_lines:o.length,tail:Gn(o.join(` L15: `)),note:null}}catch(n){return n.code==="ENOENT"?{source_path:e,tail_lines:0,tail:"",note:"no intent log present (status never run on this host)"}:{source_path:e,tail_lines:0,tail:... L16: `)}catch{}}function Bv(){if(!mo){let e=Wv().slice(0,13).replace("T","-");mo=po(gl(),`debug-${e}.log`)}Dv(Pv(mo),{recursive:!0})}function Fe(...t){ut({event:"legacy",msg:t.join(" ")... L17: `)){let r=e.trim();if(!r||r.s

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/cli/index.jsView on unpkg · L1

Source & flagged code

4 flagged · loading source

dist/cli/index.jsView file

High

Child Process

Package source references child process execution.

dist/cli/index.jsView on unpkg · L4

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli/index.jsView on unpkg · L4

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/cli/index.jsView on unpkg · L1

1var nv=Object.defineProperty;var E=(t,e)=>()=>(t&&(e=t(t=0)),e);var re=(t,e)=>{for(var r in e)nv(t,r,{get:e[r],enumerable:!0})};import{existsSync as Kr,readdirSync as sv,readFileSy... L2: `)}function ml(){return Mt(kr(),uv)}function om(){return Mt(kr(),dv)}function mv(){try{return Kr(ml())}catch{return!1}}function im(t=process.stderr){mv()&&t.write(`note: legacy ~/.... ... L4: `).map(e=>Xn(e)).join(` L5: `)}function cm(t,e){let r=t.toUpperCase();return r.includes("TOKEN")||r.includes("SECRET")||r.includes("KEY")||r.includes("PASSWORD")||r.includes("PASSWD")||r.includes("CREDENTIAL"... L6: `),f=d.slice(Math.max(0,d.length-n));c=f.length,a=Gn(f.join(` ... L14: `).filter(i=>i.length>0),o=s.slice(Math.max(0,s.length-r));return{source_path:e,tail_lines:o.length,tail:Gn(o.join(` L15: `)),note:null}}catch(n){return n.code==="ENOENT"?{source_path:e,tail_lines:0,tail:"",note:"no intent log present (status never run on this host)"}:{source_path:e,tail_lines:0,tail:... L16: `)}catch{}}function Bv(){if(!mo){let e=Wv().slice(0,13).replace("T","-");mo=po(gl(),`debug-${e}.log`)}Dv(Pv(mo),{recursive:!0})}function Fe(...t){ut({event:"legacy",msg:t.join(" ")... L17: `)){let r=e.trim();if(!r||r.s

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/cli/index.jsView on unpkg · L1

Findings

4 High2 Medium5 Low

HighChild Processdist/cli/index.js

HighShell

HighSame File Env Network Executiondist/cli/index.js

HighCommand Output Exfiltrationdist/cli/index.js

MediumNetwork

MediumEnvironment Vars

LowWeak Cryptodist/cli/index.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

4 flagged

dist/cli/index.jsView file

High

Child Process

Package source references child process execution.

dist/cli/index.jsView on unpkg · L4

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli/index.jsView on unpkg · L4

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/cli/index.jsView on unpkg · L1

1var nv=Object.defineProperty;var E=(t,e)=>()=>(t&&(e=t(t=0)),e);var re=(t,e)=>{for(var r in e)nv(t,r,{get:e[r],enumerable:!0})};import{existsSync as Kr,readdirSync as sv,readFileSy... L2: `)}function ml(){return Mt(kr(),uv)}function om(){return Mt(kr(),dv)}function mv(){try{return Kr(ml())}catch{return!1}}function im(t=process.stderr){mv()&&t.write(`note: legacy ~/.... ... L4: `).map(e=>Xn(e)).join(` L5: `)}function cm(t,e){let r=t.toUpperCase();return r.includes("TOKEN")||r.includes("SECRET")||r.includes("KEY")||r.includes("PASSWORD")||r.includes("PASSWD")||r.includes("CREDENTIAL"... L6: `),f=d.slice(Math.max(0,d.length-n));c=f.length,a=Gn(f.join(` ... L14: `).filter(i=>i.length>0),o=s.slice(Math.max(0,s.length-r));return{source_path:e,tail_lines:o.length,tail:Gn(o.join(` L15: `)),note:null}}catch(n){return n.code==="ENOENT"?{source_path:e,tail_lines:0,tail:"",note:"no intent log present (status never run on this host)"}:{source_path:e,tail_lines:0,tail:... L16: `)}catch{}}function Bv(){if(!mo){let e=Wv().slice(0,13).replace("T","-");mo=po(gl(),`debug-${e}.log`)}Dv(Pv(mo),{recursive:!0})}function Fe(...t){ut({event:"legacy",msg:t.join(" ")... L17: `)){let r=e.trim();if(!r||r.s

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/cli/index.jsView on unpkg · L1