@markus-global/cli@0.9.5
Markus — AI Digital Workforce Platform
AI Security Review
scanned 3mo ago · by lpm-firewall-aiNo malicious install-time or covert exfiltration chain was found. The package nevertheless has a deliberate, user-invoked capability to modify third-party AI-agent configuration and install agent tooling.
Static reason
One or more suspicious static signals were detected.
Trigger
User runs `markus install openclaw` or `markus install hermes` without --skip-connect.
Impact
Adds Markus integration URL/token and a skill to a selected agent platform.
Mechanism
Explicit external-agent installation and configuration mutation.
AI rationale
No malicious install-time or covert exfiltration chain was found. The package nevertheless has a deliberate, user-invoked capability to modify third-party AI-agent configuration and install agent tooling.
Evidence
package.jsondist/commands/install-agent.jsdist/connector-service.jsconnectors/openclaw.jsonconnectors/hermes.jsondist/commands/update.js~/.openclaw/openclaw.json~/.openclaw/skills/openclaw-markus-skill~/.hermes/config.json
Network endpoints1
localhost:8056
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- dist/commands/install-agent.js runs connector install/init commands after explicit `markus install <platform>`.
- dist/connector-service.js writes Markus URL/token into external agent configs and copies a skill.
- connectors/openclaw.json targets ~/.openclaw/openclaw.json and ~/.openclaw/skills.
- connectors/hermes.json targets ~/.hermes/config.json.
Evidence against
- package.json has no preinstall, install, or postinstall hooks.
- Agent-platform changes are gated by an explicit CLI subcommand.
- No source evidence of credential exfiltration, stealth persistence, or foreign control-surface mutation at install time.
- dist/commands/update.js network/shell activity is only under explicit `markus update`.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStrings
Source & flagged code
11 flaggeddist/web-ui/assets/index-BvQfZ8gL.jsView file
10patternName = generic_password
severity = medium
line = 10
matchedText = `).repla...ent.
Medium
Secret Pattern
Package contains a possible secret pattern.
dist/web-ui/assets/index-BvQfZ8gL.jsView on unpkg · L1019patternName = generic_password
severity = medium
line = 19
matchedText = `,done:"...I v2
Medium
Secret Pattern
Hardcoded password in dist/web-ui/assets/index-BvQfZ8gL.js
dist/web-ui/assets/index-BvQfZ8gL.jsView on unpkg · L19dist/web-ui/assets/Team-zOWObrjC.jsView file
14`))};if((Ee.mac||Ee.android)&&u.from==a-1&&/^\. ?$/.test(i.text)&&e.contentDOM.getAttribute("autocorrect")=="off"&&(u={from:o,to:l,insert:bt.of([i.text.replace("."," ")])}),this.pe...
L15: - -\u2028\u2029\uFEFF-]`,Zu),pC={0:"null",7:"bell",8:"backspace",10:"newline",11:"vertical tab",13:"carriage return",27:"escape",8203:"zero width space",8204:"zero wi...
L16: `:i=="r"?"\r":i=="t"?" ":"\\")}eq(e){return this.search==e.search&&this.replace==e.replace&&this.caseSensitive==e.caseSensitive&&this.regexp==e.regexp&&this.wholeWord==e.wholeWord&...
Findings
4 High10 Medium8 Low
HighChild Processdist/web-ui/assets/Team-zOWObrjC.js
HighShelldist/commands/update.js
HighSame File Env Network Executiondist/utils/browser.js
HighShips High Entropy Blobdist/markus-browser-extension.zip
MediumSecret Patterndist/web-ui/assets/index-BvQfZ8gL.js
MediumDynamic Requiredist/web-ui/assets/viz-global-C_AyN6D9.js
MediumNetwork
MediumEnvironment Vars
MediumProtestware
MediumShips Compressed Blobdist/markus-browser-extension.zip
MediumOversized Source Filedist/web-ui/assets/plantuml-DezRDxd4.js
MediumOversized Cli Entrypointdist/markus.mjs
Medium
Affected versions and remediation
This report applies to @markus-global/cli@0.9.5.
See all versions of @markus-global/cli for other recorded verdicts.
- Review the evidence and your use of @markus-global/cli@0.9.5 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.