registry / @miomioos/mio-agent / 0.3.1

@miomioos/mio-agent@0.3.1

⚠ Under review

Mio Agent — background AI worker daemon for MioIsland. Bridges Claude Code sessions to the MioMioOS server.

Static Scan Results

scanned 4d ago · by rust-scanner

Static analysis flagged 15 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedUrlStrings

Manifest

NoLicense

scanned 1 file(s), 309 KB of source, external domains: 127.0.0.1, github.com, mio.wdao.chat, www.apple.com

Source & flagged code

6 flagged

dist/cli/index.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import{createRequire as ___cr}from'module';import{fileURLToPath as ___fu}from'url';import{dirname as ___dn}from'path';const require=___cr(import.meta.url);const __filename=___fu(import.meta.url);const __dirname=___dn(__filename);

3var Yu=Object.create;var gs=Object.defineProperty;var Vu=Object.getOwnPropertyDescriptor;var Ku=Object.getOwnPropertyNames;var zu=Object.getPrototypeOf,Xu=Object.prototype.hasOwnProperty;var Z=(n=>typeof require<"u"?require:typeof Proxy<"u"?new Proxy(n,{get:(e,t)=>(

4`),1;let o=process.env.MIO_AGENT_PROXY_TOKEN_FILE;if(!o)return r.write(JSON.stringify({ok:!1,code:"MISSING_PROXY_TOKEN",message:"MIO_AGENT_PROXY_TOKEN_FILE is not set"})+`

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/cli/index.jsView on unpkg · L1

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/cli/index.jsView on unpkg · L1

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/cli/index.jsView on unpkg · L1

5`),1;let a;try{a=ao(o,"utf8").trim()}catch(u){let h=u instanceof Error?u.message:String(u);return r.write(JSON.stringify({ok:!1,code:"MISSING_PROXY_TOKEN",message:`Cannot read proxy token file: ${h}`})+`

6`),1}if(!a)return r.write(JSON.stringify({ok:!1,code:"MISSING_PROXY_TOKEN",message:"Proxy token file is empty"})+`

7`),1;let[c,l,...d]=n;return c==="message"?rf(l,d,i,a,s,t,r):c==="task"?lf(l,d,i,a,t,r):c==="reminder"?yf(l,d,i,a,t,r):c==="action"?Rf(l,d,i,a,t,r):c==="attachment"?Nf(l,d,i,a,t,r):c==="profile"?$f(l,d,i,a,t,r):(r.write(JSON.stringify({ok:!1,code:"UNKNOWN_COMMAND",message:`Unknown command: ${n.join(" ")}`})+`

8`),1)}async function rf(n,e,t,r,s,i,o){switch(n){case"check":return sf(e,t,r,i,o);case"send":return of(e,t,r,s,i,o);case"read":return af(e,t,r,i,o);case"react":return cf(e,t,r,i,o);case"reply":return df(e,t,r,s,i,o);default:return o.write(JSON.stringify({ok:!1,code:"UNKNOWN_COMMAND",message:`Unknown message subcommand: ${n??"(none)"}. Try --help.`})+`

9`),1}}async function sf(n,e,t,r,s){let i=U(n,"--channel");if(!i)return s.write(JSON.stringify({ok:!1,code:"MISSING_ARG",message:"--channel <#name> is required for message check"})+`

10`),1;let o=await ce(e,t,"check",{channel:i});return o.ok?(fo(o.data,r),0):(s.write(JSON.stringify(o.error)+`

11`),1)}async function of(n,e,t,r,s,i){let o=U(n,"--target");if(!o)return i.write(JSON.stringify({ok:!1,code:"MISSING_ARG",message:"--target <#name> is required for message send"})+`

12`),1;if(r.isTTY)return i.write(JSON.stringify({ok:!1,code:"NO_STDIN",message:'message body must be piped on stdin, e.g. mio message send --target "#x" <<EOF'})+`

13`),1;let a=await ho(r);if(a.trim()==="")return i.write(JSON.stringify({ok:!1,code:"EMPTY_MESSAGE",message:"message body is empty \u2014 nothing to send"})+`

14`),1;let c=co(),l=tr(n,"--attachment");for(let w of tr(n,"--attach-file")){let k=await ys(w,o,e,t);if(!k.ok)return i.write(JSON.stringify(k.error)+`

15`),1;l.push(k.id)}let d={target:o,content:a,clientIdempotencyKey:c};l.length>0&&(d.attachment_ids=l);let u=await ce(e,t,"send",d);if(!u.ok)return i.write(JSON.stringify(u.error)+`

16`),1;let h=u.data,f=String(h.id??""),g=String(h.short_id??h.shortId??"").slice(0,8),m=h.seq!==void 0?`seq=${h.seq} `:"",y=typeof h.routed_to=="string"?h.routed_to:"",T=typeof h.task_number=="number"?h.task_number:null,v="";return y==="thread"&&T!==null&&(v=` (auto-routed to thread of task #${T} \u2014 you have an active task in this channel, so this send went into its thread, NOT the main channel. Tell users your message is in the task thread, not main.)`),s.write(`sent: id=${f} ${g?`short=${g} `:""}${m}target=${o}${v}

17`),0}async function af(n,e,t,r,s){let i=U(n,"--channel");if(!i)return s.write(JSON.stringify({ok:!1,code:"MISSING_ARG",message:"--channel <#name> is required for message read"})+`

18`),1;let o={channel:i},a=U(n,"--after"),c=U(n,"--around"),l=U(n,"--before"),d=U(n,"--limit");if([a,c,l].filter(f=>f!==void 0).length>1)return s.write(JSON.stringify({ok:!1,code:"CONFLICTING_ANCHORS",message:"only one of --after, --around, --before may be provided"})+`

19`),1;if(a&&(o.after_seq=a),c&&(o.around=c),l&&(o.around=l),d!==void 0){let f=Number(d);if(!Number.isInteger(f)||f<=0)return s.write(JSON.stringify({ok:!1,code:"INVALID_LIMIT",message:`--limit must be a positive integer, got: ${d}`})+`

20`),1;o.limit=f}let h=await ce(e,t,"history",o);return h.ok?(fo(h.data,r),0):(s.write(JSON.stringify(h.error)+`

21`),1)}async function cf(n,e,t,r,s){let i=at(n);if(!i)return s.write(JSON.stringify({ok:!1,code:"MISSING_ARG",message:"a message id is required for message react"})+`

Long lines were clipped for display.

Lines 165-205javascript

165Environment:

166 MIO_AGENT_PROXY_URL URL of the local agent-proxy (set by the launcher)

167 MIO_AGENT_PROXY_TOKEN_FILE Path to a file containing the proxy bearer token

168 MIO_AGENT_ACTIVE_CAPABILITIES (informational; enforcement is in the proxy)

169

170Output:

171 success \u2192 canonical text on stdout, exit 0

172 failure \u2192 JSON on stderr { ok

Source & flagged code

6 flagged · loading source

dist/cli/index.jsView file

1#!/usr/bin/env node L2: import{createRequire as ___cr}from'module';import{fileURLToPath as ___fu}from'url';import{dirname as ___dn}from'path';const require=___cr(import.meta.url);const __filename=___fu(im... L3: var Yu=Object.create;var gs=Object.defineProperty;var Vu=Object.getOwnPropertyDescriptor;var Ku=Object.getOwnPropertyNames;var zu=Object.getPrototypeOf,Xu=Object.prototype.hasOwnPr... L4: `),1;let o=process.env.MIO_AGENT_PROXY_TOKEN_FILE;if(!o)return r.write(JSON.stringify({ok:!1,code:"MISSING_PROXY_TOKEN",message:"MIO_AGENT_PROXY_TOKEN_FILE is not set"})+` ... L98: `)}}async function Nf(n,e,t,r,s,i){switch(n){case"upload":return Mf(e,t,r,s,i);case"view":return Lf(e,t,r,s,i);default:return i.write(JSON.stringify({ok:!1,code:"UNKNOWN_COMMAND",m... L99: `),1}}async function ys(n,e,t,r){let s=nf(n).toLowerCase(),i=oo[s];if(!i){let u=Object.keys(oo).join(", ");return{ok:!1,error:{ok:!1,code:"UNSUPPORTED_FILE_TYPE",message:`Cannot de... L100: `),1;let o=U(n,"--target");if(!o)return s.write(JSON.stringify({ok:!1,code:"MISSING_ARG",message:"--target <#name> is required for attachment upload"})+` ... L120: `),t.avatar!==void 0){let a=Buffer.byteLength(t.avatar,"utf8");e.write(`

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/cli/index.jsView on unpkg · L1

1Trigger-reachable chain: manifest.main -> dist/cli/index.js L1: #!/usr/bin/env node L2: import{createRequire as ___cr}from'module';import{fileURLToPath as ___fu}from'url';import{dirname as ___dn}from'path';const require=___cr(import.meta.url);const __filename=___fu(im... L3: var Yu=Object.create;var gs=Object.defineProperty;var Vu=Object.getOwnPropertyDescriptor;var Ku=Object.getOwnPropertyNames;var zu=Object.getPrototypeOf,Xu=Object.prototype.hasOwnPr... L4: `),1;let o=process.env.MIO_AGENT_PROXY_TOKEN_FILE;if(!o)return r.write(JSON.stringify({ok:!1,code:"MISSING_PROXY_TOKEN",message:"MIO_AGENT_PROXY_TOKEN_FILE is not set"})+` ... L98: `)}}async function Nf(n,e,t,r,s,i){switch(n){case"upload":return Mf(e,t,r,s,i);case"view":return Lf(e,t,r,s,i);default:return i.write(JSON.stringify({ok:!1,code:"UNKNOWN_COMMAND",m... L99: `),1}}async function ys(n,e,t,r){let s=nf(n).toLowerCase(),i=oo[s];if(!i){let u=Object.keys(oo).join(", ");return{ok:!1,error:{ok:!1,code:"UNSUPPORTED_FILE_TYPE",message:`Cannot de... L100: `),1;let o=U(n,"--target");if(!o)return s.write(JSON.stringify({ok:!1,code:"MISSING_ARG",message:"--target <#name> is required for attachment upload"})+` ... L120: `),t.avatar…

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/cli/index.jsView on unpkg · L1

High

Child Process

Package source references child process execution.

dist/cli/index.jsView on unpkg · L185

185(and others from agentProxy.ts / the server) L186: `});var po={};Me(po,{runAgentcliCommand:()=>Hf});async function Hf(){return lo(process.argv.slice(3),{stdin:process.stdin,stdout:process.stdout,stderr:process.stderr})}var mo=O(()=... L187: `;for(var f=0;f<a;f+=2){s+=d.WHITE_ALL;for(var g=0;g<a;g++)c[f][g]===o&&c[f+1][g]===o?s+=d.WHITE_ALL:c[f][g]===o&&c[f+1][g]===i?s+=d.WHITE_BLACK:c[f][g]===i&&c[f+1][g]===o?s+=d.BLA... ... L197: --help Show this message L198: `)}async function nh(n){let e;try{({values:e}=zf({args:n,options:{server:{type:"string",default:xs},"device-name":{type:"string",default:vn.hostname()},help:{type:"boolean",default... L199: `);let s=e?["-n",String(t),"-F",...r]:["-n",String(t),...r],i=sh("tail",s,{stdio:"inherit"});return await new Promise(o=>{i.on("exit",c=>o(c??0)),i.on("error",c=>{console.error(`Fa... L200: `);return w.substr(0,w.length-2)},this.getRequestHeader=function(w){return typeof w=="string"&&l[w]?l[w]:""},this.send=function(w){if(this.readyState!=this.OPENED)throw new Error("... L201: `).join(`

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli/index.jsView on unpkg · L185

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/cli/index.jsView on unpkg · L185

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/cli/index.jsView on unpkg · L1

Findings

2 Critical3 High4 Medium6 Low

CriticalCredential Exfiltrationdist/cli/index.js

CriticalTrigger Reachable Dangerous Capabilitydist/cli/index.js

HighChild Processdist/cli/index.js

HighSame File Env Network Executiondist/cli/index.js

HighCommand Output Exfiltrationdist/cli/index.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/cli/index.js

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License