registry / @memnexus-ai/mx-agent-cli / 0.1.298
@memnexus-ai/mx-agent-cli@0.1.298
CLI for creating and managing AI agent teams
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe inspected execution paths support the package’s stated CLI purpose: imports do not execute commands, setup and worktree builds are command-driven, and credential requests validate their configured service URL. The flagged shell command appears in a generated Dockerfile template rather than running automatically.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
No unsolicited install-time or import-time action was identified; relevant writes and build operations follow CLI commands.
Impact
The inspected behavior is consistent with a CLI for creating and managing AI agent teams.
Mechanism
Project setup writes agent configuration, and coordination credential requests use a validated configured service URL.
AI rationale
The inspected execution paths support the package’s stated CLI purpose: imports do not execute commands, setup and worktree builds are command-driven, and credential requests validate their configured service URL. The flagged shell command appears in a generated Dockerfile template rather than running automatically.
Decision evidence
public snapshotAI called this Clean at 89.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest describes an AI-agent management CLI and exposes dist/index.js as its command-line entry point.
- Importing dist/index.js does not parse arguments or run a command; argument parsing is gated on the file being the CLI entry point.
- Project initialization writes configuration into the selected project when runInit is called.
- The npm build helper is called from the create flow to build a CLI in a worktree.
- Before using a MemNexus user key, the credential flow validates the coordination-service URL; the key is sent in a request to that configured service.
- The NodeSource download-and-run command is part of a generated Dockerfile template, not code run automatically by the package.
Evidence against
- The manifest declares prepare and prepublishOnly scripts, though the prepare target scripts/install-hooks.mjs is absent from the inspected package snapshot.
- The CLI can write agent settings and hooks, but those writes occur in its explicit project initialization flow.
- The package reads a MemNexus user key for coordination-service credentials, but the inspected flow validates the service URL and sends the key there.
Source & flagged code
8 flaggeddist/index.jsView file
70const __dirname = dirname(fileURLToPath(import.meta.url));
L71: const require = createRequire(import.meta.url);
L72: const pkg = require(join(__dirname, '../package.json'));
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/index.jsView on unpkg · L70dist/lib/cli-build.jsView file
24*/
L25: import { spawnSync } from 'child_process';
L26: import { accessSync, constants, lstatSync, realpathSync, statSync } from 'fs';
...
L74: * Everything absent from this list is dropped, which removes every `GIT_*` (the
L75: * `testing-tools/git-env.cjs:5-20` reason), every `npm_config_*`, `NODE_ENV`,
L76: * `NODE_OPTIONS`, `NODE_PATH`, `MX_*`, `ANTHROPIC_*`, `AZURE_*`, `GH_TOKEN` and
...
L150: *
L151: * npm's stderr can carry registry-supplied strings. Printing them unfiltered
L152: * into a terminal is escape-sequence injection (CWE-150): an escape run can
...
L186: * leaks the secret rather than the marker. The truncation keeps the tail, so it
L187: * removes a pattern's fixed literal prefix first: `https://`, `ghp_`,
L188: * `github_pat_`, `sk-ant-` and `Authorization:` are al
Critical
Encoded Package Runner Execution
Source decodes numeric character arrays into a child-process package-runner command and executes it.
Findings
4 Critical2 High5 Medium6 Low
CriticalEncoded Package Runner Executiondist/lib/cli-build.js
CriticalTrojan Source Unicodedist/lib/behavioral-injection.js#virtual:normalized:round1
CriticalTrigger Reachable Dangerous Capabilitydist/lib/behavioral-injection.js
CriticalPrevious Version Dangerous Deltadist/lib/coordination-token.js
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/commands/init.js
HighSemantic Analysis Limiteddist/commands/codex-prove-guards.js#virtual:normalized:round1
MediumDynamic Requiredist/index.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperdist/agent-config/hooks/git-mutation-guard.sh
MediumStructural Risk Force Deep Review
Affected versions and remediation
This report applies to @memnexus-ai/mx-agent-cli@0.1.298.
See all versions of @memnexus-ai/mx-agent-cli for other recorded verdicts.
- Review the evidence and your use of @memnexus-ai/mx-agent-cli@0.1.298 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.