AI Security Review
scanned 4d ago · by lpm-firewall-aiNo confirmed malicious attack surface was established. Risky primitives are user-invoked and aligned with a terminal AI-agent CLI, channel integrations, local state, and bundled skills.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
User runs `oriro` or explicit subcommands such as `oriro channels add/start`, router setup, scribe, avatar, or skills commands.
Impact
No evidence of unconsented credential harvesting, persistence, destructive behavior, or exfiltration.
Mechanism
Package-aligned CLI networking, local configuration writes, and defensive command scanning.
Rationale
Static inspection shows the high-severity scanner hits are mostly signatures embedded in the package's defensive Guardian rules and package-aligned AI/channel functionality. I found no install-time execution, hidden loader, unconsented secret exfiltration, persistence, or destructive payload.
Evidence
package.jsondist/cli.jsREADME.mdskills/craft/vercel-optimize/lib/vercel.mjsskills/technical/api-builder/SKILL.md~/.oriro/language.json~/.oriro/guardian.json~/.oriro/channels.json~/.oriro/scribe~/.oriro/avatars
Network endpoints6
oriro.aidiscord.com/api/v10/users/@metext.pollinations.ai/openaiapi.llm7.io/v1openrouter.ai/api/v1generativelanguage.googleapis.com/v1beta
Decision evidence
public snapshotAI called this Clean at 86.0% confidence as Benign with medium false-positive risk.
Evidence for block
- dist/cli.js is a terminal AI-agent CLI that can run user-requested workflows through imported Pi agent dependencies.
- dist/cli.js stores user-supplied Telegram/Discord channel tokens in local ~/.oriro/channels.json when `oriro channels add` is invoked.
- Bundled skills include many operational instructions and a PDF/blob, increasing review surface.
Evidence against
- package.json has no install/postinstall lifecycle; only prepublishOnly for publisher-side build/test/smoke checks.
- Scanner reverse-shell/exfil hits in dist/cli.js are defensive Guardian regex rules, not executed payloads.
- Network calls are package-aligned: router validation to AI APIs, avatar fetch from oriro.ai, and user-invoked Discord/Telegram validation.
- Shell use found is execFile/spawn for Vercel helper or local audio playback, with fixed commands/argument arrays.
- README.md describes the same AI-agent, Guardian, channels, and local journal behavior exposed by dist/cli.js.
- No native binaries or install-time droppers found in the package root.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsTelemetryUrlStrings
NoLicense
Source & flagged code
12 flagged · loading sourceskills/technical/api-builder/SKILL.mdView file
94patternName = supabase_service_key
severity = critical
line = 94
matchedText = eyJhbGci...sw5c
Critical
Critical Secret
Package contains a critical-looking secret pattern.
skills/technical/api-builder/SKILL.mdView on unpkg · L9494patternName = supabase_service_key
severity = critical
line = 94
matchedText = eyJhbGci...sw5c
Critical
Secret Pattern
Supabase service role key (JWT) in skills/technical/api-builder/SKILL.md
skills/technical/api-builder/SKILL.mdView on unpkg · L94dist/cli.jsView file
8import { createInterface as createInterface5 } from "readline/promises";
L9: import { stdin as stdin5, stdout as stdout6 } from "process";
L10:
...
L202: function oriroDir() {
L203: return process.env.ORIRO_STATE_DIR ?? join(homedir(), ".oriro");
L204: }
...
L214: try {
L215: return JSON.parse(readFileSync(file(), "utf8"));
L216: } catch {
...
L282: }
L283: stdout.write(dim("\nBye.\n"));
L284: process.exit(0);
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/cli.jsView on unpkg · L88import { createInterface as createInterface5 } from "readline/promises";
L9: import { stdin as stdin5, stdout as stdout6 } from "process";
L10:
...
L202: function oriroDir() {
L203: return process.env.ORIRO_STATE_DIR ?? join(homedir(), ".oriro");
L204: }
...
L214: try {
L215: return JSON.parse(readFileSync(file(), "utf8"));
L216: } catch {
...
L282: }
L283: stdout.write(dim("\nBye.\n"));
L284: process.exit(0);
Critical
Command Output Exfiltration
Source executes local commands and sends command output to an external endpoint.
dist/cli.jsView on unpkg · L88import { createInterface as createInterface5 } from "readline/promises";
L9: import { stdin as stdin5, stdout as stdout6 } from "process";
L10:
...
L202: function oriroDir() {
L203: return process.env.ORIRO_STATE_DIR ?? join(homedir(), ".oriro");
L204: }
...
L214: try {
L215: return JSON.parse(readFileSync(file(), "utf8"));
L216: } catch {
...
L282: }
L283: stdout.write(dim("\nBye.\n"));
L284: process.exit(0);
Critical
Reverse Shell
Source matches reverse-shell style process and socket wiring.
dist/cli.jsView on unpkg · L88Trigger-reachable chain: manifest.bin -> dist/cli.js
L8: import { createInterface as createInterface5 } from "readline/promises";
L9: import { stdin as stdin5, stdout as stdout6 } from "process";
L10:
...
L202: function oriroDir() {
L203: return process.env.ORIRO_STATE_DIR ?? join(homedir(), ".oriro");
L204: }
...
L214: try {
L215: return JSON.parse(readFileSync(file(), "utf8"));
L216: } catch {
...
L282: }
L283: stdout.write(dim("\nBye.\n"));
L284: process.exit(0);
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/cli.jsView on unpkg · L8381["ioc:obf_loader", /eval\(\s*(atob|Buffer\.from)\(/i],
L382: ["ioc:cp_loader", /child_process[\s\S]{0,40}(atob|fromCharCode)/i]
L383: ];
High
526new RegExp(`\\b(bash|sh|zsh|ksh|eval)\\b[^\\n]*\\$\\(\\s*${FETCH}\\b`, "i"),
L527: // bash -c "$(curl)"
L528: new RegExp(`\\$\\(\\s*${FETCH}\\b[^)]*\\)`, "i"),
High
8import { createInterface as createInterface5 } from "readline/promises";
L9: import { stdin as stdin5, stdout as stdout6 } from "process";
L10:
...
L202: function oriroDir() {
L203: return process.env.ORIRO_STATE_DIR ?? join(homedir(), ".oriro");
L204: }
...
L214: try {
L215: return JSON.parse(readFileSync(file(), "utf8"));
L216: } catch {
...
L282: }
L283: stdout.write(dim("\nBye.\n"));
L284: process.exit(0);
Medium
Install Persistence
Source writes installer persistence such as shell profile or service configuration.
dist/cli.jsView on unpkg · L8skills/craft/vercel-optimize/lib/vercel.mjsView file
15try {
L16: const { stdout } = await exec("vercel", ["--version"]);
L17: raw = stdout.trim();
...
L29: throw new Error(
L30: `VERCEL_CLI_TOO_OLD: have ${v.join(".")}, need >= ${MIN_CLI_VERSION.join(".")}. Upgrade with \`npm i -g vercel@latest\`.`,
L31: );
High
Runtime Package Install
Package source invokes a package manager install command at runtime.
skills/craft/vercel-optimize/lib/vercel.mjsView on unpkg · L15skills/model-usage/scripts/test_model_usage.pyView file
•path = skills/model-usage/scripts/test_model_usage.py
kind = build_helper
sizeBytes = 1310
magicHex = [redacted]
Medium
Ships Build Helper
Package ships non-JavaScript build or shell helper files.
skills/model-usage/scripts/test_model_usage.pyView on unpkgskills/theme-factory/theme-showcase.pdfView file
•path = skills/theme-factory/theme-showcase.pdf
kind = high_entropy_blob
sizeBytes = 124310
magicHex = [redacted]
High
Ships High Entropy Blob
Package ships high-entropy non-source blobs.
skills/theme-factory/theme-showcase.pdfView on unpkgFindings
6 Critical4 High5 Medium7 Low
CriticalCritical Secretskills/technical/api-builder/SKILL.md
CriticalCredential Exfiltrationdist/cli.js
CriticalCommand Output Exfiltrationdist/cli.js
CriticalReverse Shelldist/cli.js
CriticalTrigger Reachable Dangerous Capabilitydist/cli.js
CriticalSecret Patternskills/technical/api-builder/SKILL.md
HighChild Processdist/cli.js
HighShelldist/cli.js
HighRuntime Package Installskills/craft/vercel-optimize/lib/vercel.mjs
HighShips High Entropy Blobskills/theme-factory/theme-showcase.pdf
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/cli.js
MediumShips Build Helperskills/model-usage/scripts/test_model_usage.py
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
LowNo License