registry / @memnexus-ai/mx-agent-cli / 0.1.243
@memnexus-ai/mx-agent-cli@0.1.243
CLI for creating and managing AI agent teams
AI Security Review
scanned 3mo ago · by lpm-firewall-aiSource inspection confirms explicit user-invoked Claude hook/config mutation, so it warrants a warning under the lifecycle policy. No credential theft, stealth persistence, remote code loading, or unconsented install-time mutation was found.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Trigger
User runs mx-agent start for a configured team.
Impact
Changes the launched Claude session's hook/control behavior within selected worktrees.
Mechanism
Generate and reconcile Claude settings plus shell hooks
AI rationale
Source inspection confirms explicit user-invoked Claude hook/config mutation, so it warrants a warning under the lifecycle policy. No credential theft, stealth persistence, remote code loading, or unconsented install-time mutation was found.
Evidence
package.jsondist/commands/start.jsdist/lib/claude.jsdist/commands/pr-sync.jsdist/agent-config/hooks/deploy-verification-reminder.sh.claude/settings.json.claude/hooks/*AGENTS.mdCLAUDE.md~/.mx-agent/hooks/*
Network endpoints1
localhost:3100/v1/pr-sync
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- dist/commands/start.js invokes config and hook deployment on mx-agent start
- dist/lib/claude.js overwrites .claude/settings.json and managed hooks
- dist/lib/claude.js caches/reconciles hooks under ~/.mx-agent
- dist/agent-config/hooks/*.sh execute as Claude tool hooks
Evidence against
- package.json has no install lifecycle hook
- mutation requires explicit mx-agent start
- network sync is explicit/configured and defaults to localhost
- child processes use argv arrays; no eval or remote payload loader found
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsObfuscatedUrlStrings
NoLicense
Source & flagged code
6 flaggeddist/lib/fleet-data.jsView file
20import { join } from 'path';
L21: import { spawnSync } from 'child_process';
L22: import { listTeams } from './catalog.js';
High
Child Process
Package source references child process execution.
dist/lib/fleet-data.jsView on unpkg · L20dist/lib/gh-remote.jsView file
19// 1. gh present? Probe directly (shell-free) so a missing binary surfaces as a
L20: // non-zero/ null status via ENOENT. Avoids `command -v gh` under `shell: true`,
L21: // which triggers Node DEP0190 (passing args with shell option true).
High
dist/index.jsView file
Findings
4 High5 Medium7 Low
HighChild Processdist/lib/fleet-data.js
HighShelldist/lib/gh-remote.js
HighSame File Env Network Executiondist/commands/pr-sync.js
HighPrevious Version Dangerous Deltadist/lib/claude.js
MediumDynamic Requiredist/index.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperdist/agent-config/hooks/git-mutation-guard.sh
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowObfuscated
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @memnexus-ai/mx-agent-cli@0.1.243.
See all versions of @memnexus-ai/mx-agent-cli for other recorded verdicts.
- Review the evidence and your use of @memnexus-ai/mx-agent-cli@0.1.243 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.