registry / @mmerterden/multi-agent-pipeline / 17.6.0

@mmerterden/multi-agent-pipeline@17.6.0

8-phase AI development pipeline with full orchestration on Claude Code, Copilot CLI and Codex CLI. Analysis, planning, TDD, CLI-aware parallel review with consensus surfacing + Fable triage, default-FAIL evidence gates, secret + intent guards, per-phase c

AI Security Review

scanned 4d ago · by lpm-firewall-ai

The package has no install lifecycle hook, and the inspected telemetry is gated or part of explicit product setup and reporting flows. The named agent-integration locations show host-specific paths and ordinary local tooling rather than a concrete unconsented control-surface attack.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

Install telemetry requires an explicit environment opt-in; operational registration is invoked by setup or runtime reporting flows.

Impact

No malicious effect was established. Reporting can associate a user identifier and hostname with the package’s intended operational metrics.

Mechanism

The installer sends package and runtime metadata to its publisher endpoint. Registration requests a reporting token using a user identifier and shortened hostname; the inspected request does not send project content or saved credentials.

AI rationale

Network endpoints2

mmerterden.vercel.app/api/install-notifymmerterden.com/api/usage/ingest

Decision evidence

public snapshot

AI called this Clean at 92.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json declares CLI entrypoints and development scripts, with no npm lifecycle hook or runtime self-dependency.
Installer telemetry runs after the explicit install command and sends only when MULTI_AGENT_TELEMETRY is set to 1; its payload contains package and runtime metadata.
Usage registration requests a token from the package’s reporting endpoint using the GitHub login or local username and a shortened hostname; setup describes the registration step, and an opt-out is checked.
The indicated agent-integration locations resolve to plugin-cache lookup, host-specific install paths, local autopilot and doctor paths, graph output, citation validation, and companion MCP registration; they do not establish an unconsented broad agent-control mutation.

Evidence against

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

Source & flagged code

9 flagged

pipeline/scripts/keychain.pyView file

Lines 123-179python

123 info = doctor()

124 if not info["backend_ok"]:

125 sys.stderr.write(f"keychain: backend unavailable on {info['platform']}\n")

126 if info["remediation"]:

127 sys.stderr.write(f"keychain: {info['remediation']}\n")

128 sys.exit(2)

129 return info["platform"]

130

131

132def _decode_security_password(stderr: bytes) -> Optional[str]:

133 """Pull the secret out of `security ... -g` stderr and decode it.

134

135 `-w` cannot be used to read a secret this store may hold. It prints any value

136 containing a byte outside plain printable ASCII as BARE HEX with no marker,

137 which is indistinguishable from a secret that is itself hex - and 40-character

138 hex API tokens are exactly what lives here. Guessing from the shape would

139 corrupt them. `-g` marks the encoded form with an `0x` prefix, so the decision

140 is read off the output instead of inferred:

141

142 multi-line value -> password: 0x6C696E65310A6C696E6532 "line1\\012line2"

143 hex-looking value -> password: "deadbeefcafe1234"

Medium

Secret Pattern

Package contains a possible secret pattern.

pipeline/scripts/keychain.pyView on unpkg · L143

144

145 Two shapes, measured rather than assumed:

146 - `0x<HEX>` present -> the hex is authoritative; a quoted trailer may follow

147 or may be absent entirely (an all-non-ASCII value prints hex only).

148 - no `0x` -> the value sits between the first and last double quote. Inner

149 quotes are NOT escaped by `security` (`he"llo` prints as `"he"llo"`), so

150 first-to-last is the correct span and unescaping would be wrong.

151

152 The secret is parsed in-process and returned to the caller. It is never

153 logged, never placed in an exception message, and never passed as an argv

154 element.

155 """

156 for raw in stderr.split(b"\n"):

157 if not raw.startswith(b"password: "):

158 continue

159 body = raw[len(b"password: "):].rstrip(b"\r")

Medium

Secret Pattern

Hardcoded password in pipeline/scripts/keychain.py

pipeline/scripts/keychain.pyView on unpkg · L159

160 if body.startswith(b"0x"):

161 hex_digits = body[2:].split(b" ", 1)[0]

162 try:

163 return bytes.fromhex(hex_digits.decode("ascii")).decode("utf-8", errors="replace")

164 except ValueError:

165 return None

166 first = body.find(b'"')

167 last = body.rfind(b'"')

168 if first != -1 and last > first:

169 return body[first + 1:last].decode("utf-8", errors="replace")

170 return body.decode("utf-8", errors="replace")

171 return None

172

173

174def _macos_find(args: list[str]) -> Optional[str]:

175 """One `find-generic-password -g` lookup; None when the item is absent.

176

177 Trailing newlines are stripped, which is what the `-w` path did before and

178 what every consumer already assumes: a newline on the end of a token is an

179 artifact of pasting it, and it breaks an HTTP header the moment it survives.

pipeline/scripts/verify-citations.mjsView file

46import { resolve as resolvePath, sep } from "node:path"; L47: import { spawnSync } from "node:child_process"; L48:

High

Child Process

Package source references child process execution.

pipeline/scripts/verify-citations.mjsView on unpkg · L46

pipeline/scripts/skill-conformance.mjs#virtual:normalized:round1View file

366// would be extracted into the manifest and injected into every reviewer L367: // prompt via the shared ${CRITERIA} block. Contain it to the skill"s own\n // directory; a declaration that escapes is recorded, not followed.\n const rulesPath = resolv... L368: // report a clean review over criteria it never loaded.

Medium

Dynamic Require

Package source references dynamic require/import behavior.

pipeline/scripts/skill-conformance.mjs#virtual:normalized:round1View on unpkg · L366

pipeline/scripts/build-stack-plugins.mjsView file

23* L24: * Exit code 0 always (report-only); prints a JSON-ish summary + per-plugin diff. L25: */ ... L36: import { join } from "node:path"; L37: import { spawnSync } from "node:child_process"; L38: import { createHash } from "node:crypto"; ... L61: // gets a string instead of throwing a raw TypeError before any diagnostic. L62: const HOME = process.env.HOME || process.env.USERPROFILE; L63: if (!HOME) { ... L255: // regenerate plugin.json skills[]: keep non-knowledge entries, rebuild knowledge set L256: const pj = JSON.parse(readFileSync(pjPath, "utf8")); L257: const nonKnowledge = (pj.skills || []).filter((s) => !s.startsWith("./skills/knowledge/"));

Low

Weak Crypto

Package source references weak cryptographic algorithms.

pipeline/scripts/build-stack-plugins.mjsView on unpkg · L23

pipeline/scripts/usage-register.mjsView file

Lines 90-130javascript

90 // `optOut` is a choice about PASSIVE collection. /multi-agent:feedback is the

91 // opposite: somebody typed a message meant to be read, and it rides the same

92 // token. So a feedback run may mint one - and it must NOT switch telemetry on

93 // when it does, which is what `enableTelemetry` below is for.

94 if (u.optOut === true && !forFeedback)

pipeline/scripts/github-ssh-setup.shView file

•path = pipeline/scripts/github-ssh-setup.sh kind = build_helper sizeBytes = 2833 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

pipeline/scripts/github-ssh-setup.shView on unpkg

install/_mcp-register.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 15

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

install/_mcp-register.mjs#virtual:normalized:round1View on unpkg

install/_mcp-register.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @mmerterden/multi-agent-pipeline@16.28.0 matchedIdentity = npm:[redacted]:16.28.0 similarity = 0.542 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

install/_mcp-register.mjsView on unpkg

Source & flagged code

9 flagged · loading source

pipeline/scripts/keychain.pyView file

143patternName = generic_password severity = medium line = 143

Medium

Secret Pattern

Package contains a possible secret pattern.

pipeline/scripts/keychain.pyView on unpkg · L143

159patternName = generic_password severity = medium line = 159

Medium

Secret Pattern

Hardcoded password in pipeline/scripts/keychain.py

pipeline/scripts/keychain.pyView on unpkg · L159

pipeline/scripts/verify-citations.mjsView file

46import { resolve as resolvePath, sep } from "node:path"; L47: import { spawnSync } from "node:child_process"; L48:

High

Child Process

Package source references child process execution.

pipeline/scripts/verify-citations.mjs

Findings

1 Critical4 High7 Medium5 Low

CriticalPrevious Version Dangerous Deltainstall/_mcp-register.mjs

HighChild Processpipeline/scripts/verify-citations.mjs

HighShell

HighCommand Output Exfiltrationpipeline/scripts/usage-register.mjs

HighSemantic Analysis Limitedinstall/_mcp-register.mjs#virtual:normalized:round1

MediumSecret Patternpipeline/scripts/keychain.py

MediumDynamic Requirepipeline/scripts/skill-conformance.mjs#virtual:normalized:round1

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperpipeline/scripts/github-ssh-setup.sh

MediumStructural Risk Force Deep Review

MediumSecret Patternpipeline/scripts/keychain.py

Affected versions and remediation

This report applies to @mmerterden/multi-agent-pipeline@17.6.0.

See all versions of @mmerterden/multi-agent-pipeline for other recorded verdicts.

Review the evidence and your use of @mmerterden/multi-agent-pipeline@17.6.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-19 13:07:12.035Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code