registry / @miomioos/mio-agent / 0.3.10

@miomioos/mio-agent@0.3.10

Mio Agent — background AI worker daemon for MioIsland. Bridges Claude Code sessions to the MioMioOS server.

AI Security Review

scanned 3h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. No confirmed malicious attack surface is established, but the package is a powerful first-party AI agent daemon with explicit background installation and runtime agent control. Risk is user-invoked and package-aligned rather than npm install-time hijacking.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

User runs mio-agent login/start/run/install/pair-phone or daemon receives authorized server events.

Impact

Can run local agent sessions, persist as a background service when explicitly installed, and send/read/update Mio workspace data via the configured server token.

Mechanism

authorized AI-agent daemon, local proxy wrapper, LaunchAgent setup, and Claude/Codex subprocess orchestration

Rationale

Static inspection shows a legitimate but high-capability MioMioOS agent daemon: network, tokens, subprocesses, local wrappers, and LaunchAgent persistence are aligned with documented user commands and not triggered by npm install. Because it can operate an AI-agent control surface with permission-bypass runtime flags and explicit background setup, warn rather than block.

Evidence

package.jsonREADME.mddist/cli/index.jsdist/runtimes/skills/mio-messaging.mddist/runtimes/skills/mio-tasks.mddist/runtimes/skills/mio-attachments.md~/.mio/agent.json~/.mio/bin/mio-agent~/Library/LaunchAgents/io.miomioos.mio-agent.plist~/.mio/logs/mio-agent.log~/.mio/logs/mio-agent-error.log~/.mio/agent-proxy-tokens/<agent>/<launch>.token<agent workspace>/.mio/mio<agent workspace>/.mio/mcp-config.json<agent workspace>/.claude/skills/*/SKILL.md

Network endpoints4

mio.wdao.chatgithub.com/MioMioOS/mio-agent/releases/download/v<version>/127.0.0.1:7878127.0.0.1:<ephemeral>/act

Decision evidence

public snapshot

AI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

dist/cli/index.js spawns Claude/Codex agent runtimes and injects a local mio wrapper into PATH.
dist/cli/index.js launches Claude with bypass/skip-permissions flags for persona extraction.
dist/cli/index.js explicit `install --background --version` writes a LaunchAgent plist and downloads a release binary.
dist/cli/index.js forwards agent actions to configured Mio server using a machine token.
dist/runtimes/skills/*.md provide agent skills for messaging, tasks, reminders, attachments, profile updates.

Evidence against

package.json has no install/preinstall/postinstall hook; only prepublishOnly build script.
Persistence is behind explicit `mio-agent install --background --version`, not npm install-time execution.
Login stores a package-owned machine token in macOS Keychain and config under ~/.mio after QR approval.
Release download is GitHub MioMioOS-owned and verifies manifest plus SHA-256 before installing.
Network endpoints are package-aligned: default server and MioMioOS GitHub releases.
No source evidence of broad credential harvesting, destructive behavior, or covert exfiltration.

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedUrlStrings

Manifest

NoLicense

scanned 1 file(s), 315 KB of source, external domains: 127.0.0.1, github.com, mio.wdao.chat, www.apple.com

Source & flagged code

6 flagged

dist/cli/index.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import{createRequire as ___cr}from'module';import{fileURLToPath as ___fu}from'url';import{dirname as ___dn}from'path';const require=___cr(import.meta.url);const __filename=___fu(import.meta.url);const __dirname=___dn(__filename);

3var ff=Object.create;var bs=Object.defineProperty;var hf=Object.getOwnPropertyDescriptor;var pf=Object.getOwnPropertyNames;var gf=Object.getPrototypeOf,mf=Object.prototype.hasOwnProperty;var X=(n=>typeof require<"u"?require:typeof Proxy<"u"?new Proxy(n,{get:(e,t)=>(

4`),1;let o=process.env.MIO_AGENT_PROXY_TOKEN_FILE;if(!o)return r.write(JSON.stringify({ok:!1,code:"MISSING_PROXY_TOKEN",message:"MIO_AGENT_PROXY_TOKEN_FILE is not set"})+`

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/cli/index.jsView on unpkg · L1

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/cli/index.jsView on unpkg · L1

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/cli/index.jsView on unpkg · L1

5`),1;let a;try{a=_o(o,"utf8").trim()}catch(u){let m=u instanceof Error?u.message:String(u);return r.write(JSON.stringify({ok:!1,code:"MISSING_PROXY_TOKEN",message:`Cannot read proxy token file: ${m}`})+`

6`),1}if(!a)return r.write(JSON.stringify({ok:!1,code:"MISSING_PROXY_TOKEN",message:"Proxy token file is empty"})+`

7`),1;let[c,d,...l]=n;return c==="message"?kf(d,l,i,a,s,t,r):c==="task"?Rf(d,l,i,a,t,r):c==="reminder"?Lf(d,l,i,a,t,r):c==="action"?Jf(d,l,i,a,t,r):c==="attachment"?Xf(d,l,i,a,t,r):c==="profile"?eh(d,l,i,a,t,r):(r.write(JSON.stringify({ok:!1,code:"UNKNOWN_COMMAND",message:`Unknown command: ${n.join(" ")}`})+`

8`),1)}async function kf(n,e,t,r,s,i,o){switch(n){case"check":return Sf(e,t,r,i,o);case"send":return Ef(e,t,r,s,i,o);case"read":return xf(e,t,r,i,o);case"react":return Tf(e,t,r,i,o);case"reply":return Cf(e,t,r,s,i,o);default:return o.write(JSON.stringify({ok:!1,code:"UNKNOWN_COMMAND",message:`Unknown message subcommand: ${n??"(none)"}. Try --help.`})+`

9`),1}}async function Sf(n,e,t,r,s){let i=U(n,"--channel");if(!i)return s.write(JSON.stringify({ok:!1,code:"MISSING_ARG",message:"--channel <#name> is required for message check"})+`

10`),1;let o=await le(e,t,"check",{channel:i});return o.ok?(ko(o.data,r),0):(s.write(JSON.stringify(o.error)+`

11`),1)}async function Ef(n,e,t,r,s,i){if(n.includes("--help")||n.includes("-h"))return s.write(`\u7528\u6CD5: mio message send --target "#\u9891\u9053\u540D" <<EOF

12\u6D88\u606F\u5185\u5BB9(stdin \u4F20\u5165,\u652F\u6301\u591A\u884C)

13EOF

14\u53EF\u9009: --thread <\u6D88\u606Fid> \u56DE\u590D\u5230\u6307\u5B9A\u6D88\u606F\u7684 thread

15`),0;let o=U(n,"--target");if(!o)return i.write(JSON.stringify({ok:!1,code:"MISSING_ARG",message:"--target <#name> is required for message send (--help \u67E5\u770B\u7528\u6CD5)"})+`

16`),1;if(r.isTTY)return i.write(JSON.stringify({ok:!1,code:"NO_STDIN",message:'message body must be piped on stdin, e.g. mio message send --target "#x" <<EOF'})+`

17`),1;let a=await So(r);if(a.trim()==="")return i.write(JSON.stringify({ok:!1,code:"EMPTY_MESSAGE",message:"message body is empty \u2014 nothing to send"})+`

18`),1;let c=wo(),d=or(n,"--attachment");for(let _ of or(n,"--attach-file")){let k=await Es(_,o,e,t);if(!k.ok)return i.write(JSON.stringify(k.error)+`

19`),1;d.push(k.id)}let l={target:o,content:a,clientIdempotencyKey:c};d.length>0&&(l.attachment_ids=d);let u=await le(e,t,"send",l);if(!u.ok)return i.write(JSON.stringify(u.error)+`

20`),1;let m=u.data,f=String(m.id??""),p=String(m.short_id??m.shortId??"").slice(0,8),g=m.seq!==void 0?`seq=${m.seq} `:"",y=typeof m.routed_to=="string"?m.routed_to:"",E=typeof m.task_number=="number"?m.task_number:null,w="";return y==="thread"&&E!==null&&(w=` (auto-routed to thread of task #${E} \u2014 you have an active task in this channel, so this

21`),0}async function xf(n,e,t,r,s){let i=U(n,"--channel");if(!i)return s.write(JSON.stringify({ok:!1,code:"MISSING_ARG",message:"--channel <#name> is required for message read"})+`

Long lines were clipped for display.

Lines 169-209javascript

169Environment:

170 MIO_AGENT_PROXY_URL URL of the local agent-proxy (set by the launcher)

171 MIO_AGENT_PROXY_TOKEN_FILE Path to a file containing the proxy bearer token

172 MIO_AGENT_ACTIVE_CAPABILITIES (informational; enforcement is in the proxy)

173

174Output:

175 success \u2192 canonical text on stdout, exit 0

176 failure \u2192 JSON on stderr { ok

Source & flagged code

6 flagged · loading source

dist/cli/index.jsView file

1#!/usr/bin/env node L2: import{createRequire as ___cr}from'module';import{fileURLToPath as ___fu}from'url';import{dirname as ___dn}from'path';const require=___cr(import.meta.url);const __filename=___fu(im... L3: var ff=Object.create;var bs=Object.defineProperty;var hf=Object.getOwnPropertyDescriptor;var pf=Object.getOwnPropertyNames;var gf=Object.getPrototypeOf,mf=Object.prototype.hasOwnPr... L4: `),1;let o=process.env.MIO_AGENT_PROXY_TOKEN_FILE;if(!o)return r.write(JSON.stringify({ok:!1,code:"MISSING_PROXY_TOKEN",message:"MIO_AGENT_PROXY_TOKEN_FILE is not set"})+` ... L102: `)}}async function Xf(n,e,t,r,s,i){switch(n){case"upload":return Qf(e,t,r,s,i);case"view":return Zf(e,t,r,s,i);default:return i.write(JSON.stringify({ok:!1,code:"UNKNOWN_COMMAND",m... L103: `),1}}async function Es(n,e,t,r){let s=bf(n).toLowerCase(),i=yo[s];if(!i){let u=Object.keys(yo).join(", ");return{ok:!1,error:{ok:!1,code:"UNSUPPORTED_FILE_TYPE",message:`Cannot de... L104: `),1;let o=U(n,"--target");if(!o)return s.write(JSON.stringify({ok:!1,code:"MISSING_ARG",message:"--target <#name> is required for attachment upload"})+` ... L124: `),t.avatar!==void 0){let a=Buffer.byteLength(t.avatar,"utf8");e.write

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/cli/index.jsView on unpkg · L1

1Trigger-reachable chain: manifest.main -> dist/cli/index.js L1: #!/usr/bin/env node L2: import{createRequire as ___cr}from'module';import{fileURLToPath as ___fu}from'url';import{dirname as ___dn}from'path';const require=___cr(import.meta.url);const __filename=___fu(im... L3: var ff=Object.create;var bs=Object.defineProperty;var hf=Object.getOwnPropertyDescriptor;var pf=Object.getOwnPropertyNames;var gf=Object.getPrototypeOf,mf=Object.prototype.hasOwnPr... L4: `),1;let o=process.env.MIO_AGENT_PROXY_TOKEN_FILE;if(!o)return r.write(JSON.stringify({ok:!1,code:"MISSING_PROXY_TOKEN",message:"MIO_AGENT_PROXY_TOKEN_FILE is not set"})+` ... L102: `)}}async function Xf(n,e,t,r,s,i){switch(n){case"upload":return Qf(e,t,r,s,i);case"view":return Zf(e,t,r,s,i);default:return i.write(JSON.stringify({ok:!1,code:"UNKNOWN_COMMAND",m... L103: `),1}}async function Es(n,e,t,r){let s=bf(n).toLowerCase(),i=yo[s];if(!i){let u=Object.keys(yo).join(", ");return{ok:!1,error:{ok:!1,code:"UNSUPPORTED_FILE_TYPE",message:`Cannot de... L104: `),1;let o=U(n,"--target");if(!o)return s.write(JSON.stringify({ok:!1,code:"MISSING_ARG",message:"--target <#name> is required for attachment upload"})+` ... L124: `),t.avat…

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/cli/index.jsView on unpkg · L1

High

Child Process

Package source references child process execution.

dist/cli/index.jsView on unpkg · L189

189(and others from agentProxy.ts / the server) L190: `});var xo={};$e(xo,{runAgentcliCommand:()=>ih});async function ih(){return vo(process.argv.slice(3),{stdin:process.stdin,stdout:process.stdout,stderr:process.stderr})}var To=O(()=... L191: `;for(var f=0;f<a;f+=2){s+=l.WHITE_ALL;for(var p=0;p<a;p++)c[f][p]===o&&c[f+1][p]===o?s+=l.WHITE_ALL:c[f][p]===o&&c[f+1][p]===i?s+=l.WHITE_BLACK:c[f][p]===i&&c[f+1][p]===o?s+=l.BLA... ... L201: --help Show this message L202: `)}async function vh(n){let e;try{({values:e}=ph({args:n,options:{server:{type:"string",default:Is},"device-name":{type:"string",default:kn.hostname()},help:{type:"boolean",default... L203: `);let s=e?["-n",String(t),"-F",...r]:["-n",String(t),...r],i=kh("tail",s,{stdio:"inherit"});return await new Promise(o=>{i.on("exit",c=>o(c??0)),i.on("error",c=>{console.error(`Fa... L204: `);return _.substr(0,_.length-2)},this.getRequestHeader=function(_){return typeof _=="string"&&d[_]?d[_]:""},this.send=function(_){if(this.readyState!=this.OPENED)throw new Error("... L205: `).join(`

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli/index.jsView on unpkg · L189

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/cli/index.jsView on unpkg · L189

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/cli/index.jsView on unpkg · L1

Findings

2 Critical3 High4 Medium6 Low

CriticalCredential Exfiltrationdist/cli/index.js

CriticalTrigger Reachable Dangerous Capabilitydist/cli/index.js

HighChild Processdist/cli/index.js

HighSame File Env Network Executiondist/cli/index.js

HighCommand Output Exfiltrationdist/cli/index.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/cli/index.js

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

6 flagged

dist/cli/index.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

4`),1;let o=process.env.MIO_AGENT_PROXY_TOKEN_FILE;if(!o)return r.write(JSON.stringify({ok:!1,code:"MISSING_PROXY_TOKEN",message:"MIO_AGENT_PROXY_TOKEN_FILE is not set"})+`

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/cli/index.jsView on unpkg · L1

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/cli/index.jsView on unpkg · L1

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/cli/index.jsView on unpkg · L1

6`),1}if(!a)return r.write(JSON.stringify({ok:!1,code:"MISSING_PROXY_TOKEN",message:"Proxy token file is empty"})+`

9`),1}}async function Sf(n,e,t,r,s){let i=U(n,"--channel");if(!i)return s.write(JSON.stringify({ok:!1,code:"MISSING_ARG",message:"--channel <#name> is required for message check"})+`

10`),1;let o=await le(e,t,"check",{channel:i});return o.ok?(ko(o.data,r),0):(s.write(JSON.stringify(o.error)+`

11`),1)}async function Ef(n,e,t,r,s,i){if(n.includes("--help")||n.includes("-h"))return s.write(`\u7528\u6CD5: mio message send --target "#\u9891\u9053\u540D" <<EOF

12\u6D88\u606F\u5185\u5BB9(stdin \u4F20\u5165,\u652F\u6301\u591A\u884C)

13EOF

14\u53EF\u9009: --thread <\u6D88\u606Fid> \u56DE\u590D\u5230\u6307\u5B9A\u6D88\u606F\u7684 thread

15`),0;let o=U(n,"--target");if(!o)return i.write(JSON.stringify({ok:!1,code:"MISSING_ARG",message:"--target <#name> is required for message send (--help \u67E5\u770B\u7528\u6CD5)"})+`

16`),1;if(r.isTTY)return i.write(JSON.stringify({ok:!1,code:"NO_STDIN",message:'message body must be piped on stdin, e.g. mio message send --target "#x" <<EOF'})+`

17`),1;let a=await So(r);if(a.trim()==="")return i.write(JSON.stringify({ok:!1,code:"EMPTY_MESSAGE",message:"message body is empty \u2014 nothing to send"})+`

18`),1;let c=wo(),d=or(n,"--attachment");for(let _ of or(n,"--attach-file")){let k=await Es(_,o,e,t);if(!k.ok)return i.write(JSON.stringify(k.error)+`

19`),1;d.push(k.id)}let l={target:o,content:a,clientIdempotencyKey:c};d.length>0&&(l.attachment_ids=d);let u=await le(e,t,"send",l);if(!u.ok)return i.write(JSON.stringify(u.error)+`

21`),0}async function xf(n,e,t,r,s){let i=U(n,"--channel");if(!i)return s.write(JSON.stringify({ok:!1,code:"MISSING_ARG",message:"--channel <#name> is required for message read"})+`

Long lines were clipped for display.

Lines 169-209javascript

169Environment:

170 MIO_AGENT_PROXY_URL URL of the local agent-proxy (set by the launcher)

171 MIO_AGENT_PROXY_TOKEN_FILE Path to a file containing the proxy bearer token

172 MIO_AGENT_ACTIVE_CAPABILITIES (informational; enforcement is in the proxy)

173

174Output:

175 success \u2192 canonical text on stdout, exit 0

176 failure \u2192 JSON on stderr { ok