registry / @m8t-stack/cli / 0.2.12
@m8t-stack/cli@0.2.12
CLI for managing m8t-stack deployments on Azure / Microsoft Agent Foundry
AI Security Review
scanned 4mo ago · by lpm-firewall-aiStatic inspection shows suspicious primitives are expected for this CLI's documented Azure/GitHub/Foundry management functions and are activated by explicit commands. No lifecycle execution, credential harvesting, covert endpoint, persistence, destructive payload, or unconsented AI-agent control-surface mutation was found.
Static reason
One or more suspicious static signals were detected.
Trigger
User runs the m8t CLI commands.
Impact
Can modify the user's configured Azure/GitHub/Foundry resources when invoked with appropriate credentials; no hidden install-time or import-time exfiltration found.
Mechanism
User-directed cloud management CLI with Azure/GitHub auth, local config writes, and agent version updates.
AI rationale
Static inspection shows suspicious primitives are expected for this CLI's documented Azure/GitHub/Foundry management functions and are activated by explicit commands. No lifecycle execution, credential harvesting, covert endpoint, persistence, destructive payload, or unconsented AI-agent control-surface mutation was found.
Evidence
package.jsonREADME.mddist/cli.js~/.m8t-stack/cli-config.yaml~/.m8t-stack/github-app.pem~/.m8t-stack/github-app.json.m8t/brain.yaml
Network endpoints7
api.github.commanagement.azure.comai.azure.com/.defaultapi.githubcopilot.com/mcpghcr.iograph.microsoft.comapi.openai.com/v1
Decision evidence
public snapshotAI called this Clean at 90.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
Evidence against
- package.json has no install/postinstall hook; prepublishOnly only runs pnpm build for publishers.
- dist/cli.js entrypoint registers Clipanion commands and runs only when the CLI is invoked.
- child_process usage is limited to user-invoked az, gh, git, open/start/xdg-open, and brain-eval commands.
- Network calls are aligned with documented Azure, GitHub, GHCR, OpenAI SDK, and user-configured gateway operations.
- Secret reads/writes are for Azure Key Vault GitHub App auth and local m8t config/credential files documented in README.md.
- AI-agent instruction/tool mutations occur in explicit brain/a2a commands for Foundry agent management, not lifecycle or hidden execution.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
2 flagged · loading sourcedist/cli.jsView file
11445init_errors();
L11446: import { spawn } from "child_process";
L11447: function runAz(args) {
High
19321);
L19322: this.context.stdout.write(
L19323: colors.dim("next: run 'm8t doctor' to verify gateway + data-plane access.\n")
...
L19329: // src/commands/open.ts
L19330: import { spawn as spawn5 } from "child_process";
L19331: import { Command as Command41, Option as Option39 } from "clipanion";
...
L19335: var OPEN_TARGETS = ["webapp", "foundry", "portal"];
L19336: var FOUNDRY_PORTAL_URL = "https://ai.azure.com";
L19337: function azurePortalRgUrl(tenantId, subscriptionId, resourceGroup) {
High
Command Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
dist/cli.jsView on unpkg · L19321Findings
3 High2 Medium5 Low
HighChild Processdist/cli.js
HighShell
HighCommand Output Exfiltrationdist/cli.js
MediumNetwork
MediumEnvironment Vars
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @m8t-stack/cli@0.2.12.
See all versions of @m8t-stack/cli for other recorded verdicts.
- Review the evidence and your use of @m8t-stack/cli@0.2.12 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.