@markus-global/cli@0.9.6
Markus — AI Digital Workforce Platform
AI Security Review
scanned 3mo ago · by lpm-firewall-aiNo concrete malicious or unconsented install-time behavior was found. The package nevertheless provides explicit-user agent configuration and browser-automation capability, warranting a warn verdict under the stated policy.
Static reason
One or more suspicious static signals were detected.
Trigger
User runs `markus install <platform>` without `--skip-connect`.
Impact
Adds a Markus-controlled integration token and, for OpenClaw, a packaged skill to a third-party agent environment.
Mechanism
Explicit agent-platform installation and config/skill injection.
AI rationale
No concrete malicious or unconsented install-time behavior was found. The package nevertheless provides explicit-user agent configuration and browser-automation capability, warranting a warn verdict under the stated policy.
Evidence
package.jsondist/commands/install-agent.jsdist/connector-service.jsconnectors/openclaw.jsonconnectors/hermes.jsondist/markus-browser-extension.ziptemplates/openclaw-markus-skill/~/.openclaw/openclaw.json~/.openclaw/skills/openclaw-markus-skill~/.hermes/config.json
Network endpoints2
localhost:8056ws://127.0.0.1:9333
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- Explicit `markus install <platform>` installs and initializes external agent CLIs.
- It writes Markus URL/token into OpenClaw or Hermes configs and copies an OpenClaw skill.
- Bundled browser extension has debugger and `<all_urls>` permissions, but is not install-time executed.
Evidence against
- `package.json` has no preinstall/install/postinstall hooks.
- Agent-platform changes occur only after an explicit CLI command.
- API client targets configured/local Markus server; no credential-exfiltration path found.
- Update downloads are user-invoked `markus update` behavior.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsMinifiedObfuscatedProtestwareTelemetryUrlStrings
Source & flagged code
11 flaggeddist/web-ui/assets/index-BMzsi3-i.jsView file
10patternName = generic_password
severity = medium
line = 10
matchedText = `).repla...ent.
Medium
Secret Pattern
Package contains a possible secret pattern.
dist/web-ui/assets/index-BMzsi3-i.jsView on unpkg · L1019patternName = generic_password
severity = medium
line = 19
matchedText = `,done:"...I v2
Medium
Secret Pattern
Hardcoded password in dist/web-ui/assets/index-BMzsi3-i.js
dist/web-ui/assets/index-BMzsi3-i.jsView on unpkg · L19dist/web-ui/assets/Team-D_C3tvWh.jsView file
14`))};if((Ee.mac||Ee.android)&&u.from==a-1&&/^\. ?$/.test(i.text)&&e.contentDOM.getAttribute("autocorrect")=="off"&&(u={from:o,to:l,insert:bt.of([i.text.replace("."," ")])}),this.pe...
L15: - -\u2028\u2029\uFEFF-]`,Zu),pC={0:"null",7:"bell",8:"backspace",10:"newline",11:"vertical tab",13:"carriage return",27:"escape",8203:"zero width space",8204:"zero wi...
L16: `:i=="r"?"\r":i=="t"?" ":"\\")}eq(e){return this.search==e.search&&this.replace==e.replace&&this.caseSensitive==e.caseSensitive&&this.regexp==e.regexp&&this.wholeWord==e.wholeWord&...
Findings
4 High10 Medium8 Low
HighChild Processdist/web-ui/assets/Team-D_C3tvWh.js
HighShelldist/commands/update.js
HighSame File Env Network Executiondist/utils/browser.js
HighShips High Entropy Blobdist/markus-browser-extension.zip
MediumSecret Patterndist/web-ui/assets/index-BMzsi3-i.js
MediumDynamic Requiredist/web-ui/assets/viz-global-C_AyN6D9.js
MediumNetwork
MediumEnvironment Vars
MediumProtestware
MediumShips Compressed Blobdist/markus-browser-extension.zip
MediumOversized Source Filedist/web-ui/assets/plantuml-DezRDxd4.js
MediumOversized Cli Entrypointdist/markus.mjs
Medium
Affected versions and remediation
This report applies to @markus-global/cli@0.9.6.
See all versions of @markus-global/cli for other recorded verdicts.
- Review the evidence and your use of @markus-global/cli@0.9.6 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.