registry / @memnexus-ai/mx-agent-cli / 0.1.293
@memnexus-ai/mx-agent-cli@0.1.293
CLI for creating and managing AI agent teams
AI Security Review
scanned 3mo ago · by lpm-firewall-aiWarn for the deliberate, user-triggered AI-agent extension lifecycle surface. No evidence supports a malicious publish block because installation does not execute code or mutate agent control surfaces.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Running mx-agent codex deploy-config, agent setup/start flows, or mx-agent pr-sync.
Impact
Configured hooks can execute in later agent sessions after platform trust; the sync command sends user-selected project metrics and its configured token.
Mechanism
Project-local AI-agent hook/config deployment and opt-in telemetry sync.
AI rationale
Warn for the deliberate, user-triggered AI-agent extension lifecycle surface. No evidence supports a malicious publish block because installation does not execute code or mutate agent control surfaces.
Evidence
package.jsondist/index.jsdist/lib/claude.jsdist/commands/pr-sync.jsdist/commands/codex-deploy-config.js.codex/config.toml.codex/hooks.jsonAGENTS.override.md.claude/settings.json.claude/hooks/~/.claude/projects/
Network endpoints1
localhost:3100/v1/pr-sync
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Explicit `codex deploy-config` writes worktree `.codex` configuration and hook definitions.
- Claude configuration reconciliation writes command hooks into `.claude/settings.json`, including PreToolUse.
- Explicit `pr-sync` posts PR/session-derived records with a configured bearer token to the configured API.
Evidence against
- package.json has no preinstall, install, or postinstall hook; its only lifecycle script is prepublishOnly.
- CLI parsing runs only when the bin entrypoint is invoked, not on import.
- Codex deployment states hooks remain inert until a human grants trust and rejects the main-repository hook file.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
7 flaggeddist/lib/fleet-data.jsView file
20import { join } from 'path';
L21: import { spawnSync } from 'child_process';
L22: import { listTeams } from './catalog.js';
High
Child Process
Package source references child process execution.
dist/lib/fleet-data.jsView on unpkg · L20dist/lib/gh-remote.jsView file
57// 1. gh present? Probe directly (shell-free) so a missing binary surfaces as a
L58: // non-zero/ null status via ENOENT. Avoids `command -v gh` under `shell: true`,
L59: // which triggers Node DEP0190 (passing args with shell option true).
High
dist/index.jsView file
Findings
5 High5 Medium6 Low
HighChild Processdist/lib/fleet-data.js
HighShelldist/lib/gh-remote.js
HighSame File Env Network Executiondist/commands/pr-sync.js
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/lib/claude.js
HighPrevious Version Dangerous Deltadist/commands/new.js
MediumDynamic Requiredist/index.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperdist/agent-config/hooks/git-mutation-guard.sh
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to @memnexus-ai/mx-agent-cli@0.1.293.
See all versions of @memnexus-ai/mx-agent-cli for other recorded verdicts.
- Review the evidence and your use of @memnexus-ai/mx-agent-cli@0.1.293 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.