registry / @memnexus-ai/mx-agent-cli / 0.1.292
@memnexus-ai/mx-agent-cli@0.1.292
CLI for creating and managing AI agent teams
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThis is not concrete malicious behavior, but its explicit-command agent-extension lifecycle and session telemetry create a real reviewable control surface. Per policy, downgrade to warn rather than block.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Trigger
User runs `mx-agent start` or `mx-agent sync`; deployed hooks may subsequently run in the configured agent runtime.
Impact
Can alter behavior of Claude/Codex sessions in the selected project and send parsed session records to the configured service.
Mechanism
Project-local AI-agent configuration and hook deployment with opt-in session telemetry.
AI rationale
This is not concrete malicious behavior, but its explicit-command agent-extension lifecycle and session telemetry create a real reviewable control surface. Per policy, downgrade to warn rather than block.
Evidence
package.jsondist/commands/start.jsdist/lib/claude.jsdist/lib/runtime/codex-config.jsdist/commands/sync.js.claude/settings.json.claude/hooks/~/.mx-agent/hooks/.codex/config.toml.codex/hooks.jsonAGENTS.mdCLAUDE.md
Network endpoints2
registry.npmjs.org/@memnexus-ai/mx-agent-cli/latestlocalhost:3100/v1/sessions/sync
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- `mx-agent start` deploys Claude configuration and hooks into a selected worktree.
- Codex runtime deployment writes project-local `.codex/config.toml` and `.codex/hooks.json`.
- The explicit `sync` command uploads parsed local session records to a configured observability API.
Evidence against
- No preinstall/install/postinstall lifecycle hook; only `prepublishOnly` is declared.
- The control-surface writes occur during explicit CLI start/configuration, not package installation.
- Network upload uses an operator-configured URL/token; no covert fixed exfiltration endpoint was confirmed.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
7 flaggeddist/lib/fleet-data.jsView file
20import { join } from 'path';
L21: import { spawnSync } from 'child_process';
L22: import { listTeams } from './catalog.js';
High
Child Process
Package source references child process execution.
dist/lib/fleet-data.jsView on unpkg · L20dist/lib/gh-remote.jsView file
57// 1. gh present? Probe directly (shell-free) so a missing binary surfaces as a
L58: // non-zero/ null status via ENOENT. Avoids `command -v gh` under `shell: true`,
L59: // which triggers Node DEP0190 (passing args with shell option true).
High
dist/index.jsView file
Findings
5 High5 Medium6 Low
HighChild Processdist/lib/fleet-data.js
HighShelldist/lib/gh-remote.js
HighSame File Env Network Executiondist/commands/pr-sync.js
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/lib/claude.js
HighPrevious Version Dangerous Deltadist/commands/start.js
MediumDynamic Requiredist/index.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperdist/agent-config/hooks/git-mutation-guard.sh
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to @memnexus-ai/mx-agent-cli@0.1.292.
See all versions of @memnexus-ai/mx-agent-cli for other recorded verdicts.
- Review the evidence and your use of @memnexus-ai/mx-agent-cli@0.1.292 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.