Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Loading npm security reports…

@mamdouh-aboammar/agent-kernel@1.9.0: Suspicious npm security | LPM Firewall

Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Flagged as AI-agent capability risk

Allowed by default with warning: agent-facing configuration or capability changes need review before use.

View on npm All versions Policy details

registry / @mamdouh-aboammar/agent-kernel / 1.9.0

@mamdouh-aboammar/agent-kernel@1.9.0

Local-first governance kernel for AI coding agents — shared memory, rule distribution, approval inbox, episodic memory archive, MCP tools, and strict enforcement hooks.

AI Security Review

scanned 16h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

No blocking static signals were detected.

Trigger

User runs `sync`, `enforce install`, `link`, `git-hook install`, `start`, or daemon commands.

Impact

Can alter local AI-agent behavior and project hook behavior after direct invocation.

Mechanism

Explicit agent-control and hook configuration plus local memory daemon.

Rationale

No concrete malicious behavior is established, but explicit commands mutate agent-control surfaces and hooks, creating a real dangerous-capability risk that should be disclosed to firewall users.

Evidence

package.jsondist/cli.mjsbin/agent-kernel-safe-link.mjsbin/agent-kernel-safe-git-hook.mjsbin/agent-kernel-daemon.mjsbin/architecture-guardian/imports.mjs~/.claude/settings.json~/.claude/hooks/session-end

Network endpoints1

127.0.0.1:3999

Decision evidence

public snapshot

© 2026 LPM Firewall

Product

Threat feed How it works Policy

LPM

LPM.dev Registry

AI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

`dist/cli.mjs` explicit `sync` writes global Codex, Claude, and Gemini guidance files.
`dist/cli.mjs` explicit `enforce install` modifies `~/.claude/settings.json` and installs a Claude session hook.
`bin/agent-kernel-safe-link.mjs` explicitly injects managed blocks into project agent-control files.
`bin/agent-kernel-safe-git-hook.mjs` explicitly installs a guarded Git pre-commit hook.
`bin/agent-kernel-daemon.mjs` starts a local HTTP daemon and persists local session observations.

Evidence against

`package.json` has no `preinstall`, `install`, or `postinstall` lifecycle hook.
No outbound HTTP client, `fetch`, download, or credential-exfiltration path found in `bin/` or `dist/`.
Daemon defaults to `127.0.0.1` and rejects non-local hosts unless an environment opt-in is set.
`bin/architecture-guardian/imports.mjs` parses import syntax; it does not dynamically load code.
Child-process calls route explicit CLI commands or invoke Git/selected agent binaries.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 58 file(s), 487 KB of source, external domains: 127.0.0.1, agent-kernel.local, json-schema.org

Source & flagged code

5 flagged · loading source

bin/agent-kernel-failure.mjsView file

5import crypto from 'node:crypto'; L6: import childProcess from 'node:child_process'; L7: import { fileURLToPath } from 'node:url';

High

Child Process

Package source references child process execution.

bin/agent-kernel-failure.mjsView on unpkg · L5

dist/cli.mjsView file

1531print(`Starting ${agent} in ${project}`); L1532: const child = childProcess.spawn(bin, args, { cwd: project, stdio: 'inherit', shell: true }); L1533: child.on('exit', code => process.exit(code ?? 0));

High

Shell

Package source references shell execution.

dist/cli.mjsView on unpkg · L1531

bin/architecture-guardian/imports.mjsView file

66ruby(text) { L67: return unique([...text.matchAll(/^\s*require(?:_relative)?\s+['"]([^'"]+)['"]/gm)].map((match) => match[1])); L68: },

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/architecture-guardian/imports.mjsView on unpkg · L66

bin/agent-kernel-daemon.mjsView file

1#!/usr/bin/env node L2: import childProcess from 'node:child_process'; L3: import crypto from 'node:crypto'; L4: import fs from 'node:fs'; L5: import http from 'node:http'; L6: import os from 'node:os'; ... L14: function kernelHome() { L15: return process.env.AGENT_KERNEL_HOME || path.join(os.homedir(), '.agent-kernel'); L16: }

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

bin/agent-kernel-daemon.mjsView on unpkg · L1

bin/install-local.shView file

•path = bin/install-local.sh kind = build_helper sizeBytes = 264 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/install-local.shView on unpkg

Findings

3 High5 Medium4 Low

HighChild Processbin/agent-kernel-failure.mjs

HighShelldist/cli.mjs

HighSame File Env Network Executionbin/agent-kernel-daemon.mjs

MediumDynamic Requirebin/architecture-guardian/imports.mjs

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperbin/install-local.sh

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

88%Warn

Verdict confidence

IntentDangerous Capability

TypeAI-agent capability abuse

False-positive riskMedium

Review stagesource_first_review

Firewall policyWarn-only AI-agent capability risk

Package metadata

npm

AuthorMamdouh Aboammar

Maintainersmamdouh-aboammar

Version1.11.0

PublishedJul 14, 2026

LicenseMIT

Dependencies0

Integrityverified

Package size299 KB

Files451

Keywordsagentic-codingai-agentsclaude-codecodexcursorantigravityAGENTS.mdMCP

LinksRepository Homepage Issues

Runtime surface

package.json

Entrypointsbin → agent-kernel, agent-kernel-agent-propose, agent-kernel-agent-write +9

Runtimenode >=18.18.0

Artifact1.07 MB · 451 files1 signature(s) · provenance

Install lifecycleNo install hooks · other: build, check-version, dev, docs:check +6

Behavioral surface

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellHighEntropyStringsUrlStringsManifest: clean

LPM CLI

Source & flagged code

5 flagged

bin/agent-kernel-failure.mjsView file

Lines 1-25javascript

1#!/usr/bin/env node

2import fs from 'node:fs';

3import os from 'node:os';

4import path from 'node:path';

5import crypto from 'node:crypto';

6import childProcess from 'node:child_process';

7import { fileURLToPath } from 'node:url';

High

Child Process

Package source references child process execution.

bin/agent-kernel-failure.mjsView on unpkg · L5

8

9const here = path.dirname(fileURLToPath(import.meta.url));

10const TEXT_LIMIT = 120000;

11const EXCERPT_LIMIT = 4000;

12

13function print(message = '') { process.stdout.write(String(message) + '\n'); }

14function fail(message, code = 1) { process.stderr.write(String(message) + '\n'); process.exitCode = code; }

15

16function parseArgs(argv) {

17 const flags = { _: [] };

18 for (let i = 0; i < argv.length; i++) {

19 const arg = argv[i];

20 if (arg.startsWith('--')) {

21 const raw = arg.slice(2);

22 const eq = raw.indexOf('=');

23 if (eq >= 0) flags[raw.slice(0, eq)] = raw.slice(eq + 1);

24 else {

25 const next = argv[i + 1];

dist/cli.mjsView file

Lines 1511-1551javascript

1511}

1512

1513function commandGitHook(flags = {}) {

1514 const root = gitRoot(flags._?.[0] || process.cwd());

bin/architecture-guardian/imports.mjsView file

Lines 46-86javascript

46 go(text) {

47 const values = [];

48 for (const match of text.matchAll(/import\s+(?:[A-Za-z0-9_\.

bin/agent-kernel-daemon.mjsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import childProcess from 'node:child_process';

3import crypto from 'node:crypto';

4import fs from 'node:fs';

5import http from

bin/install-local.shView file

•path = bin/install-local.sh kind = build_helper sizeBytes = 264 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/install-local.shView on unpkg

1515 const ok = installGitHook(root);

1516 print(ok ? `Installed pre-commit hook in ${root}` : `No .git directory found in ${root}`);

1517}

1518

1519function commandStart(flags = {}) {

1520 const agent = flags._?.[0];

1521 const projectArg = flags._?.[1] || '.';

1522 if (!agent) { error('Usage: agent-kernel start <claude|codex|cursor|antigravity|gemini> [project]'); process.exitCode = 1; return; }

1523 const project = path.resolve(projectArg);

1524 if (!exists(project)) { error(`Project not found: ${project}`); process.exitCode = 1; return; }

1525 commandLink({ _: [project] });

1526 commandCompile({ quiet: true });

1527 const commandMap = { claude: 'claude', codex: 'codex', cursor: 'cursor', antigravity: 'antigravity', gemini: 'gemini' };

1528 const bin = commandMap[agent];

1529 if (!bin) { error(`Unsupported agent: ${agent}`); process.exitCode = 1; return; }

1530 const args = agent === 'cursor' || agent === 'antigravity' ? [project] : [];

1531 print(`Starting ${agent} in ${project}`);

1532 const child = childProcess.spawn(bin, args, { cwd: project, stdio: 'inherit', shell: true });

1533 child.on('exit', code => process.exit(code ?? 0));

High

Shell

Package source references shell execution.

dist/cli.mjsView on unpkg · L1531

1534}

1535

1536

1537function safeJson(value) {

1538 try { return JSON.stringify(value, null, 2); } catch { return String(value); }

1539}

1540

1541function parseMcpArgs(args = {}) {

1542 if (!args || typeof args !== 'object') return {};

1543 return args;

1544}

1545

1546function jsonRpcResult(idValue, result) {

1547 return { jsonrpc: '2.0', id: idValue, result };

1548}

1549

1550function jsonRpcError(idValue, code, message, data) {

1551 return { jsonrpc: '2.0', id: idValue ?? null, error: { code, message, ...(data ? { data } : {}) } };

]

+

\s

+

)

?

"(

[

^

"]

+

)"/

g

)) values.

push

(match[

1

]);

49 for (const block of text.matchAll(/import\s*\(([^)]+)\)/gs)) {

50 for (const match of block[1].matchAll(/(?:[A-Za-z0-9_\.]+\s+)?"([^"]+)"/g)) values.push(match[1]);

51 }

52 return unique(values);

53 },

54 rust(text) {

55 const values = [];

56 for (const match of text.matchAll(/^\s*(?:use|mod)\s+([^;]+);/gm)) values.push(match[1].trim());

57 return unique(values);

58 },

59 java(text) {

60 return unique([...text.matchAll(/^\s*import\s+(?:static\s+)?([^;]+);/gm)].map((match) => match[1].trim()));

61 },

62 kotlin(text) { return EXTRACTORS.java(text); },

63 csharp(text) {

64 return unique([...text.matchAll(/^\s*using\s+([^;=]+);/gm)].map((match) => match[1].trim()));

65 },

66 ruby(text) {

67 return unique([...text.matchAll(/^\s*require(?:_relative)?\s+['"]([^'"]+)['"]/gm)].map((match) => match[1]));

68 },

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/architecture-guardian/imports.mjsView on unpkg · L66

69 php(text) {

70 return unique([...text.matchAll(/(?:require|include)(?:_once)?\s*\(?\s*['"]([^'"]+)['"]/g)].map((match) => match[1]));

71 },

72 swift(text) {

73 return unique([...text.matchAll(/^\s*import\s+([A-Za-z0-9_\.]+)/gm)].map((match) => match[1]));

74 }

75};

76

77export function extractImports(file, text) {

78 const language = languageForFile(file);

79 const extractor = EXTRACTORS[language];

80 return extractor ? extractor(String(text || '')) : [];

81}

82

83export function packageName(specifier, language = 'javascript') {

84 if (!specifier || specifier.startsWith('.') || specifier.startsWith('/') || specifier.startsWith('#')) return null;

85 if (language === 'javascript' || language === 'typescript') {

86 const root = specifier.startsWith('@') ? specifier.split('/').slice(0, 2).join('/') : specifier.split('/')[0];

'node:http'

;

6import os from 'node:os';

7import path from 'node:path';

8import { fileURLToPath } from 'node:url';

9

10const VERSION = '1.9.0';

11const here = path.dirname(fileURLToPath(import.meta.url));

12const selfPath = path.join(here, 'agent-kernel-daemon.mjs');

13

14function kernelHome() {

15 return process.env.AGENT_KERNEL_HOME || path.join(os.homedir(), '.agent-kernel');

16}

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

bin/agent-kernel-daemon.mjsView on unpkg · L1

17

18function nowIso() {

19 return new Date().toISOString();

20}

21