@memnexus-ai/mx-agent-cli@0.1.300
CLI for creating and managing AI agent teams
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe startup report includes identifying machine and project fields and captured output, then ships to the configured observability API when a token is present. This appears tied to the package's dashboard feature, but runtime telemetry carrying identifying details warrants a warning.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Running `mx-agent start` with an observability token configured.
Impact
The observability service receives machine and project identifiers and startup log entries, creating a privacy risk.
Mechanism
The command captures startup output, writes a report locally, then POSTs it with a bearer token to the configured observability API.
AI rationale
The startup report includes identifying machine and project fields and captured output, then ships to the configured observability API when a token is present. This appears tied to the package's dashboard feature, but runtime telemetry carrying identifying details warrants a warning.
Evidence
dist/commands/start.jsdist/lib/startup-report.jsdist/lib/startup-shipper.js~/.mx-agent/logs/startup/<worktree>.jsonl~/.mx-agent/logs/startup/spool/<uuid>.json~/.mx-agent/logs/startup/events-spool/<uuid>.json
Network endpoints3
localhost:3100/v1/startup-reports<configured observability-api-url>/v1/startup-reports<configured observability-api-url>/v1/events
Decision evidence
public snapshotAI called this Suspicious at 89.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Startup reports include project, team, worktree, CLI version, and machine name.
- The start command captures output and schedules best-effort report shipping.
- With an observability token configured, reports are POSTed to the observability API.
Evidence against
- Shipping is part of the CLI's stated observability and dashboard behavior, and requires an observability token.
- The package exposes the behavior through an explicit CLI command; the flagged agent-configuration writes occur in the explicit project setup command.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
8 flaggeddist/index.jsView file
70const __dirname = dirname(fileURLToPath(import.meta.url));
L71: const require = createRequire(import.meta.url);
L72: const pkg = require(join(__dirname, '../package.json'));
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/index.jsView on unpkg · L70dist/lib/cli-build.jsView file
24*/
L25: import { spawnSync } from 'child_process';
L26: import { accessSync, constants, lstatSync, realpathSync, statSync } from 'fs';
...
L74: * Everything absent from this list is dropped, which removes every `GIT_*` (the
L75: * `testing-tools/git-env.cjs:5-20` reason), every `npm_config_*`, `NODE_ENV`,
L76: * `NODE_OPTIONS`, `NODE_PATH`, `MX_*`, `ANTHROPIC_*`, `AZURE_*`, `GH_TOKEN` and
...
L150: *
L151: * npm's stderr can carry registry-supplied strings. Printing them unfiltered
L152: * into a terminal is escape-sequence injection (CWE-150): an escape run can
...
L186: * leaks the secret rather than the marker. The truncation keeps the tail, so it
L187: * removes a pattern's fixed literal prefix first: `https://`, `ghp_`,
L188: * `github_pat_`, `sk-ant-` and `Authorization:` are al
Critical
Encoded Package Runner Execution
Source decodes numeric character arrays into a child-process package-runner command and executes it.
Findings
4 Critical2 High5 Medium6 Low
CriticalEncoded Package Runner Executiondist/lib/cli-build.js
CriticalTrojan Source Unicodedist/lib/behavioral-injection.js#virtual:normalized:round1
CriticalTrigger Reachable Dangerous Capabilitydist/lib/behavioral-injection.js
CriticalPrevious Version Dangerous Deltadist/commands/start.js
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/commands/init.js
HighSemantic Analysis Limiteddist/commands/codex-prove-guards.js#virtual:normalized:round1
MediumDynamic Requiredist/index.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperdist/agent-config/hooks/git-mutation-guard.sh
MediumStructural Risk Force Deep Review
Affected versions and remediation
This report applies to @memnexus-ai/mx-agent-cli@0.1.300.
See all versions of @memnexus-ai/mx-agent-cli for other recorded verdicts.
- Review the evidence and your use of @memnexus-ai/mx-agent-cli@0.1.300 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.