@lotics/cli@0.312.2
Lotics SDK and CLI for AI agents
AI Security Review
scanned 25d ago · by lpm-firewall-aiSource inspection confirms an opt-in telemetry path that forwards the active API key to LOTICS_API_URL without a destination allowlist. This is conditional credential exposure, so the package warrants a warning rather than a publish block.
Static reason
One or more suspicious static signals were detected.
Trigger
An invocation with LOTICS_TELEMETRY=1 that reaches telemetry flushing after a workspace client is initialized.
Impact
A key may be disclosed to an operator-configured endpoint that is not restricted to the intended Lotics service.
Mechanism
The telemetry POST uses ctx.apiKey as a Bearer credential and ctx.apiUrl as its destination; LOTICS_API_URL can override the hosted default.
AI rationale
Source inspection confirms an opt-in telemetry path that forwards the active API key to LOTICS_API_URL without a destination allowlist. This is conditional credential exposure, so the package warrants a warning rather than a publish block.
Evidence
dist/src/cli.js~/.lotics/telemetry-<shard>.ndjson
Network endpoints2
api.lotics.ai${baseUrl}/v1/cli/telemetry
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Telemetry is disabled unless LOTICS_TELEMETRY is set to 1.
- When telemetry is enabled, its POST sends a Bearer API key with event data.
- The telemetry destination can be set through LOTICS_API_URL; the same configured URL is used for the authenticated telemetry request.
- The required agent integration location is a static documentation-source entry, not an agent configuration write.
Evidence against
- package.json defines only a prepublishOnly build hook, with no install-time execution hook.
- The CLI defaults its API destination to api.lotics.ai; the credential-bearing telemetry request requires the explicit telemetry opt-in.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsPossibleObfuscationUrlStrings
Source & flagged code
8 flaggeddist/src/cli.jsView file
46522// src/cli_dispatch.ts
L46523: import { spawn as spawn2 } from "node:child_process";
L46524:
High
Child Process
Package source references child process execution.
dist/src/cli.jsView on unpkg · L4652246543// docs/cli_reference.md
L46544: var cli_reference_default = "# @lotics/cli \u2014 CLI Command Reference\n\nPer-command syntax, flags, contracts, and gotchas for the public `lotics` CLI. Start at [AGENTS.md](../AG...
L46545:
High
661loggedProperties[propertyName] = true;
L662: _logger2["default"].log("error", 'Handlebars: Access has been denied to resolve the property "' + propertyName + '" because it is not an "own property" of its parent.\nYou can add ...
L663: }
...
L955: },
L956: data: function data(value, depth) {
L957: while (value && depth--) {
...
L2968:
L2969: // ../../node_modules/handlebars/node_modules/source-map/lib/base64.js
L2970: var require_base64 = __commonJS({
...
L5756: (function() {
L5757: var reservedWords = "break else new var case finally return void catch for switch while continue function this with default if throw delete in try do instanceof typeof abstract enu...
L5758: var compilerWords = JavaScriptCompiler.RESERVED_WORDS = {};
Findings
8 High4 Medium6 Low
HighChild Processdist/src/cli.js
HighShelldist/src/cli.js
HighHost Fingerprint Exfiltrationdist/src/cli.js
HighCredential Redirect Persistencedist/src/cli.js
HighCommand Output Exfiltrationdist/src/cli.js
HighSandbox Evasion Gated Capabilitydist/src/cli.js
HighRemote Agent Bridgedist/src/cli.js
HighTrigger Reachable Command Output Exfiltrationdist/src/cli.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumWildcard Dependency
LowNon Install Lifecycle Scripts
LowScripts Present
Affected versions and remediation
This report applies to @lotics/cli@0.312.2.
See all versions of @lotics/cli for other recorded verdicts.
- Review the evidence and your use of @lotics/cli@0.312.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.