@memnexus-ai/mx-agent-cli@0.1.296
CLI for creating and managing AI agent teams
AI Security Review
scanned 21d ago · by lpm-firewall-aiThis warrants a warning because explicit project setup writes wildcard Claude Code permissions into project settings. The manifest does not connect that setup to an npm install hook, and the inspected credential path validates its recipient before sending the MemNexus key.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
The operator invokes `mx-agent init`.
Impact
Claude Code agents in that project receive broad command and file access. No install-hook attack or untrusted credential recipient was established.
Mechanism
The command writes a settings template with wildcard Bash and file-access permissions, then deploys it to `.claude/settings.json`.
AI rationale
This warrants a warning because explicit project setup writes wildcard Claude Code permissions into project settings. The manifest does not connect that setup to an npm install hook, and the inspected credential path validates its recipient before sending the MemNexus key.
Evidence
dist/commands/init.jsdist/lib/templates.jsdist/index.jsmx-agent-system/agent-config/settings.json.claude/settings.json
Decision evidence
public snapshotAI called this Suspicious at 84.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- package.json defines a CLI, a build-only prepublish hook, and a prepare command; it has no preinstall, install, or postinstall hook.
- The explicit `mx-agent init` command scaffolds agent settings and copies them to `.claude/settings.json`; its template grants wildcard Bash, read, write, and edit permissions.
- Other indicated locations cover a removed bootstrap overwrite, config conflict handling, Codex trust and proof gates, session-history reads, Git roster reads, and managed-hook caching.
- Coordination credential setup validates the selected URL before reading the operator's MemNexus key, using a separate credential-host suffix setting, then sends the key in the request header.
Evidence against
- The broad Claude permissions are installed through explicit project setup, not an npm install hook.
- The coordination credential path checks the URL before reading or sending the key; no untrusted recipient was established.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVars
Source & flagged code
11 flaggeddist/lib/fleet-data.jsView file
20import { join } from 'path';
L21: import { spawnSync } from 'child_process';
L22: import { listTeams } from './catalog.js';
High
Child Process
Package source references child process execution.
dist/lib/fleet-data.jsView on unpkg · L20dist/lib/vm-health.js#virtual:normalized:round1View file
101/** Drains swap immediately without a VM restart. Windows host, elevated shell. */
L102: export const SWAP_DRAIN_COMMAND = "wsl -d <distro> -u root sh -c \"swapoff -a && swapon -a\"";
L103: /**
High
Shell
Package source references shell execution.
dist/lib/vm-health.js#virtual:normalized:round1View on unpkg · L101dist/index.jsView file
Findings
4 Critical5 High5 Medium6 Low
CriticalEncoded Package Runner Executiondist/lib/cli-build.js
CriticalTrojan Source Unicodedist/lib/behavioral-injection.js#virtual:normalized:round1
CriticalTrigger Reachable Dangerous Capabilitydist/lib/behavioral-injection.js
CriticalPrevious Version Dangerous Deltadist/commands/coordination.js
HighChild Processdist/lib/fleet-data.js
HighShelldist/lib/vm-health.js#virtual:normalized:round1
HighSame File Env Network Executiondist/commands/pr-sync.js
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/commands/init.js
HighSemantic Analysis Limiteddist/commands/codex-prove-guards.js#virtual:normalized:round1
MediumDynamic Requiredist/index.js
Affected versions and remediation
This report applies to @memnexus-ai/mx-agent-cli@0.1.296.
See all versions of @memnexus-ai/mx-agent-cli for other recorded verdicts.
- Review the evidence and your use of @memnexus-ai/mx-agent-cli@0.1.296 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.