registry / @m8t-stack/cli / 0.2.22
@m8t-stack/cli@0.2.22
CLI for managing m8t-stack deployments on Azure / Microsoft Agent Foundry
AI Security Review
scanned 4mo ago · by lpm-firewall-aiStatic inspection shows a large but coherent operator CLI whose network, subprocess, secret, and file operations are tied to documented user commands. With no install-time hooks, stealth persistence, foreign control-surface mutation, or unrelated exfiltration, the scanner findings are package-aligned and noisy rather than malicious.
Static reason
One or more suspicious static signals were detected.
Trigger
Running explicit m8t commands such as brain link/create, deploy, bootstrap, bind, team, doctor, or eval.
Impact
Can modify the user's own Azure, GitHub, Foundry, and local m8t-stack resources when commanded, but no stealth or install-time abuse was identified.
Mechanism
User-invoked Azure/GitHub management CLI with local config writes and subprocess calls
AI rationale
Static inspection shows a large but coherent operator CLI whose network, subprocess, secret, and file operations are tied to documented user commands. With no install-time hooks, stealth persistence, foreign control-surface mutation, or unrelated exfiltration, the scanner findings are package-aligned and noisy rather than malicious.
Evidence
package.jsonREADME.mddist/cli.js~/.m8t-stack/config.yaml~/.m8t-stack/cli-config.yaml~/.m8t-stack/repo-root~/.m8t-stack/github-app.pem~/.m8t-stack/github-app.json/tmp/m8t-brain-create-*
Network endpoints5
api.github.commanagement.azure.comai.azure.comauth.openai.com/oauth/tokenapi.openai.com/v1
Decision evidence
public snapshotAI called this Clean at 92.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- dist/cli.js contains user-invoked network calls to GitHub and Azure APIs and reads Azure Key Vault/GitHub App credentials for brain-link workflows.
- dist/cli.js uses child_process spawn/spawnSync/execFileSync for expected az, gh, git, and browser-opening helper commands.
- dist/cli.js writes local operational state such as ~/.m8t-stack github app credentials, config, repo-root markers, temp brain repos, and generated verdict/feed files.
Evidence against
- package.json has no preinstall/install/postinstall hook; only prepublishOnly builds before publishing.
- README.md describes an operator CLI for m8t-stack Azure/GitHub deployment management, matching observed functionality.
- dist/cli.js activates through the m8t bin and cli.run(process.argv.slice(2)); no hidden install-time behavior found.
- Network endpoints are package-aligned: api.github.com, management.azure.com, ai.azure.com, and user/discovered Azure project URLs.
- Secret handling is used to mint GitHub App tokens and patch Foundry connections; no unrelated credential harvesting or exfiltration path found.
- Local file writes are explicit command effects under ~/.m8t-stack, temp directories, or user-specified outputs, not broad AI-agent control hijack at install time.
Source & flagged code
2 flagged · loading sourcedist/cli.jsView file
11482init_errors();
L11483: import { spawn } from "child_process";
L11484: function runAz(args) {
High
22173);
L22174: this.context.stdout.write(
L22175: colors.dim("next: run 'm8t doctor' to verify gateway + data-plane access.\n")
...
L22181: // src/commands/open.ts
L22182: import { spawn as spawn5 } from "child_process";
L22183: import { Command as Command44, Option as Option41 } from "clipanion";
...
L22187: var OPEN_TARGETS = ["webapp", "foundry", "portal"];
L22188: var FOUNDRY_PORTAL_URL = "https://ai.azure.com";
L22189: function azurePortalRgUrl(tenantId, subscriptionId, resourceGroup) {
High
Command Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
dist/cli.jsView on unpkg · L22173Findings
3 High2 Medium5 Low
HighChild Processdist/cli.js
HighShell
HighCommand Output Exfiltrationdist/cli.js
MediumNetwork
MediumEnvironment Vars
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @m8t-stack/cli@0.2.22.
See all versions of @m8t-stack/cli for other recorded verdicts.
- Review the evidence and your use of @m8t-stack/cli@0.2.22 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.