registry / @m8t-stack/cli / 0.2.17
@m8t-stack/cli@0.2.17
CLI for managing m8t-stack deployments on Azure / Microsoft Agent Foundry
AI Security Review
scanned 4mo ago · by lpm-firewall-aiStatic inspection shows a broad but package-aligned deployment/admin CLI with no install-time execution, covert credential harvesting, or unconsented AI-agent control-surface mutation. The scanner findings are explained by documented user-invoked Azure/GitHub/Foundry workflows.
Static reason
One or more suspicious static signals were detected.
Trigger
User runs m8t commands such as brain link/create, a2a enable, deploy, bootstrap, or azure-exec deploy.
Impact
Can mutate Azure, GitHub, Foundry agents, local m8t config, and repos as documented for an operations CLI; no covert persistence or exfiltration identified.
Mechanism
User-invoked cloud administration CLI with GitHub/Azure API calls and local tool subprocesses.
AI rationale
Static inspection shows a broad but package-aligned deployment/admin CLI with no install-time execution, covert credential harvesting, or unconsented AI-agent control-surface mutation. The scanner findings are explained by documented user-invoked Azure/GitHub/Foundry workflows.
Evidence
package.jsonREADME.mddist/cli.js~/.m8t-stack/cli-config.yaml~/.m8t-stack/github-app.pem~/.m8t-stack/github-app.json~/.m8t-stack/foundry/<agent>.yamlapps/web/.env.local
Network endpoints6
api.github.commanagement.azure.comai.azure.com/.defaultapi.githubcopilot.com/mcpghcr.ioapi.openai.com/v1
Decision evidence
public snapshotAI called this Clean at 90.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- dist/cli.js contains child_process use for az, gh, git, open/xdg-open/start, and pnpm.
- dist/cli.js can create/update GitHub repos and Foundry agents/connections when CLI commands are invoked.
- dist/cli.js adds MCP tools with require_approval:"never" for m8t brain/a2a workflows, but through explicit brain/a2a commands.
Evidence against
- package.json has no install/postinstall/prepare hook; only prepublishOnly build is publisher-side.
- package.json bin points to dist/cli.js; execution is user-invoked as m8t CLI.
- README.md describes an Azure/GitHub m8t-stack operations CLI matching observed behavior.
- Network calls target package-aligned Azure, GitHub, GHCR, OpenAI SDK, and GitHub Copilot MCP endpoints.
- Secrets are read from Azure Key Vault/local user-specified app credentials for GitHub App token rotation; no unrelated exfil path found.
- Local writes are documented config/state under ~/.m8t-stack, temp brain repo staging, and explicit project files for CLI workflows.
Behavioral surface
ChildProcessCrypto
Source & flagged code
2 flagged · loading sourcedist/cli.jsView file
11478init_errors();
L11479: import { spawn } from "child_process";
L11480: function runAz(args) {
High
20694);
L20695: this.context.stdout.write(
L20696: colors.dim("next: run 'm8t doctor' to verify gateway + data-plane access.\n")
...
L20702: // src/commands/open.ts
L20703: import { spawn as spawn5 } from "child_process";
L20704: import { Command as Command42, Option as Option40 } from "clipanion";
...
L20708: var OPEN_TARGETS = ["webapp", "foundry", "portal"];
L20709: var FOUNDRY_PORTAL_URL = "https://ai.azure.com";
L20710: function azurePortalRgUrl(tenantId, subscriptionId, resourceGroup) {
High
Command Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
dist/cli.jsView on unpkg · L20694Findings
3 High2 Medium5 Low
HighChild Processdist/cli.js
HighShell
HighCommand Output Exfiltrationdist/cli.js
MediumNetwork
MediumEnvironment Vars
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @m8t-stack/cli@0.2.17.
See all versions of @m8t-stack/cli for other recorded verdicts.
- Review the evidence and your use of @m8t-stack/cli@0.2.17 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.