@nalvietnam/avatar-cli@3.33.0
AI harness CLI for NAL Vietnam engineering
AI Security Review
scanned 24d ago · by lpm-firewall-aiThe source establishes explicit CLI-driven AI-agent configuration changes but not unconsented lifecycle mutation or an active attack. Under the agent integration policy, this is a non-blocking dangerous capability.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
A user runs the relevant Avatar CLI setup or tool-enable command.
Impact
This grants the selected tooling influence over an AI-agent workspace or global skill directory; no covert activation was confirmed.
Mechanism
The CLI merges tool manifests into settings and invokes GitNexus setup for global skills.
AI rationale
The source establishes explicit CLI-driven AI-agent configuration changes but not unconsented lifecycle mutation or an active attack. Under the agent integration policy, this is a non-blocking dangerous capability.
Evidence
dist/index.js
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The CLI exposes an explicit command that enables tools by merging a manifest into workspace settings and recording state.
- Its GitNexus setup phase invokes a setup command described as installing global skills under the user's Claude configuration.
- The package install hook only loads a welcome-screen module, rather than invoking the agent setup path.
Evidence against
- No automatic agent-configuration mutation was found in the npm lifecycle hook.
- No concrete credential theft, destructive action, or hidden remote payload execution was identified in the inspected paths.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
NoLicense
Source & flagged code
10 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node ./bin/postinstall.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node ./bin/postinstall.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/index.jsView file
1// @nalvietnam/avatar-cli — built with tsup
L2: var Sp=Object.defineProperty;var I=(t,e)=>()=>(t&&(e=t(t=0)),e);var bt=(t,e)=>{for(var n in e)Sp(t,n,{get:e[n],enumerable:!0})};function $t(t){let e={schema_version:1,...t};e.schem...
L3: `)}function ye(t,e){process.stderr.write(`${JSON.stringify({schema_version:1,command:t,error:e})}
...
L10: `),plain:t=>Qe(`${t}
L11: `)}});var Se={};bt(Se,{atomicSwapDir:()=>tn,computeFileSha256:()=>$o,copyDirRecursive:()=>Ze,downloadFile:()=>Po,ensureDir:()=>S,extractTarballToDir:()=>Ro,pathExists:()=>d,readJso...
L12: `,n)}async function Ze(t,e,n=[]){await S(e);let r=await W.readdir(t,{withFileTypes:!0});for(let o of r){if(n.includes(o.name))continue;let i=Bn(t,o.name),s=Bn(e,o.name);if(o.isDire...
L13: `).filter(c=>c.trim().length>0)):r(new Error(`tar
Findings
3 Critical6 High4 Medium6 Low
CriticalCommand Output Exfiltrationdist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
CriticalPrevious Version Dangerous Deltadist/index.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/index.js
HighShelldist/index.js
HighSame File Env Network Executiondist/index.js
HighExternal Ai Agent Control Surface Mutationdist/index.js
HighTrigger Reachable Command Output Exfiltrationdist/index.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
Affected versions and remediation
This report applies to @nalvietnam/avatar-cli@3.33.0.
See all versions of @nalvietnam/avatar-cli for other recorded verdicts.
- Review the evidence and your use of @nalvietnam/avatar-cli@3.33.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.