registry  /  @oriro/orirocli  /  0.1.9

@oriro/orirocli@0.1.9

ORIRO — a free, on-device-friendly terminal AI agent. Built on the Pi agent harness (used as a library).

AI Security Review

scanned 4d ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
User invokes bundled Impeccable/Graphify skill scripts or commands, or an agent chooses them after skill loading.
Impact
Could modify repository files or agent hook configuration if run in a project context.
Mechanism
user-invoked AI agent permission bypass and hook installation
Policy narrative
The scanner's reverse-shell and credential-exfiltration hits in dist/cli.js are primarily security-rule regex catalogs used by the package Guardian. The unresolved risk is from bundled skill scripts: Impeccable can launch Codex/Claude in bypass-permissions modes to apply edits, and Graphify can install local agent hooks when explicitly invoked. I found no consumer lifecycle trigger that activates those paths automatically.
Rationale
Static inspection does not support a publish block for covert malware, but the bundled permission-bypassing agent runner and hook installers are significant user-invoked dangerous capabilities. Marking warn/suspicious is appropriate because activation appears explicit rather than install-time or hidden.
Evidence
package.jsondist/cli.jsskills/impeccable/scripts/live-copy-edit-agent.mjsskills/graphify/__main__.pyskills/craft/uipm-design-system/scripts/generate-tokens.cjs.codex/hooks.json.gemini/settings.json~/.oriro/channels.json
Network endpoints4
discord.com/api/v10/users/@metext.pollinations.ai/openaiapi.llm7.io/v1openrouter.ai/api/v1

Decision evidence

public snapshot
AI called this Suspicious at 78.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
  • skills/impeccable/scripts/live-copy-edit-agent.mjs spawns codex with --dangerously-bypass-approvals-and-sandbox for copy-edit application.
  • skills/impeccable/scripts/live-copy-edit-agent.mjs can spawn claude with --permission-mode bypassPermissions.
  • skills/graphify/__main__.py has explicit install commands that write .codex/hooks.json and .gemini/settings.json hooks.
Evidence against
  • package.json has no consumer install/postinstall/preinstall hook; prepublishOnly is publisher-side only.
  • dist/cli.js reverse-shell/exfil matches are defensive Guardian regex rules, not executed payloads.
  • dist/cli.js network use is package-aligned: LLM providers plus user-configured Telegram/Discord/WhatsApp channels.
  • Credential-looking channel tokens are validated and stored locally under ~/.oriro/channels.json after explicit user command.
  • skills/craft/uipm-design-system/scripts/generate-tokens.cjs only reads token JSON and writes generated CSS/Tailwind output.
Behavioral surface
Source
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
Supply chain
HighEntropyStringsMinifiedTelemetryUrlStrings
Manifest
NoLicense
scanned 156 file(s), 2.27 MB of source, external domains: ai-gateway.vercel.sh, aihorde.net, airtable.com, aistudio.google.com, anyscale.com, api.ai21.com, api.assemblyai.com, api.berget.ai, api.cerebras.ai, api.cloudflare.com, api.cohere.ai, api.deepseek.com, api.endpoints.anyscale.com, api.fireworks.ai, api.groq.com, api.hyperbolic.xyz, api.imgflip.com, api.inference.net, api.llm7.io, api.mistral.ai, api.moonshot.ai, api.nlpcloud.io, api.novita.ai, api.portkey.ai, api.replicate.com, api.sambanova.ai, api.scaleway.ai, api.siliconflow.cn, api.slack.com, api.stability.ai, api.studio.nebius.ai, api.together.ai, api.together.xyz, api.upstage.ai, api.wavespeed.ai, api.x.ai, api.z.ai, app.hyperbolic.xyz, assemblyai.com, baseten.co, berget.ai, build.nvidia.com, chutes.ai, cloud.cerebras.ai, cloud.google.com, cloud.sambanova.ai, console.groq.com, console.mistral.ai, console.scaleway.com, console.upstage.ai

Source & flagged code

19 flagged · loading source
skills/technical/api-builder/SKILL.mdView file
94patternName = supabase_service_key severity = critical line = 94 matchedText = eyJhbGci...sw5c
Critical
Critical Secret

Package contains a critical-looking secret pattern.

skills/technical/api-builder/SKILL.mdView on unpkg · L94
94patternName = supabase_service_key severity = critical line = 94 matchedText = eyJhbGci...sw5c
Critical
Secret Pattern

Supabase service role key (JWT) in skills/technical/api-builder/SKILL.md

skills/technical/api-builder/SKILL.mdView on unpkg · L94
dist/cli.jsView file
8import { createInterface as createInterface5 } from "readline/promises"; L9: import { stdin as stdin5, stdout as stdout6 } from "process"; L10: ... L202: function oriroDir() { L203: return process.env.ORIRO_STATE_DIR ?? join(homedir(), ".oriro"); L204: } ... L214: try { L215: return JSON.parse(readFileSync(file(), "utf8")); L216: } catch { ... L282: } L283: stdout.write(dim("\nBye.\n")); L284: process.exit(0);
Critical
Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/cli.jsView on unpkg · L8
8import { createInterface as createInterface5 } from "readline/promises"; L9: import { stdin as stdin5, stdout as stdout6 } from "process"; L10: ... L202: function oriroDir() { L203: return process.env.ORIRO_STATE_DIR ?? join(homedir(), ".oriro"); L204: } ... L214: try { L215: return JSON.parse(readFileSync(file(), "utf8")); L216: } catch { ... L282: } L283: stdout.write(dim("\nBye.\n")); L284: process.exit(0);
Critical
Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

dist/cli.jsView on unpkg · L8
8import { createInterface as createInterface5 } from "readline/promises"; L9: import { stdin as stdin5, stdout as stdout6 } from "process"; L10: ... L202: function oriroDir() { L203: return process.env.ORIRO_STATE_DIR ?? join(homedir(), ".oriro"); L204: } ... L214: try { L215: return JSON.parse(readFileSync(file(), "utf8")); L216: } catch { ... L282: } L283: stdout.write(dim("\nBye.\n")); L284: process.exit(0);
Critical
Reverse Shell

Source matches reverse-shell style process and socket wiring.

dist/cli.jsView on unpkg · L8
8Trigger-reachable chain: manifest.bin -> dist/cli.js L8: import { createInterface as createInterface5 } from "readline/promises"; L9: import { stdin as stdin5, stdout as stdout6 } from "process"; L10: ... L202: function oriroDir() { L203: return process.env.ORIRO_STATE_DIR ?? join(homedir(), ".oriro"); L204: } ... L214: try { L215: return JSON.parse(readFileSync(file(), "utf8")); L216: } catch { ... L282: } L283: stdout.write(dim("\nBye.\n")); L284: process.exit(0);
Critical
Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/cli.jsView on unpkg · L8
381["ioc:obf_loader", /eval\(\s*(atob|Buffer\.from)\(/i], L382: ["ioc:cp_loader", /child_process[\s\S]{0,40}(atob|fromCharCode)/i] L383: ];
High
Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L381
526new RegExp(`\\b(bash|sh|zsh|ksh|eval)\\b[^\\n]*\\$\\(\\s*${FETCH}\\b`, "i"), L527: // bash -c "$(curl)" L528: new RegExp(`\\$\\(\\s*${FETCH}\\b[^)]*\\)`, "i"),
High
Shell

Package source references shell execution.

dist/cli.jsView on unpkg · L526
8import { createInterface as createInterface5 } from "readline/promises"; L9: import { stdin as stdin5, stdout as stdout6 } from "process"; L10: ... L202: function oriroDir() { L203: return process.env.ORIRO_STATE_DIR ?? join(homedir(), ".oriro"); L204: } ... L214: try { L215: return JSON.parse(readFileSync(file(), "utf8")); L216: } catch { ... L282: } L283: stdout.write(dim("\nBye.\n")); L284: process.exit(0);
Medium
Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/cli.jsView on unpkg · L8
skills/craft/uipm-design-system/scripts/generate-tokens.cjsView file
9L10: const fs = require("fs"); L11: const path = require("path");
Medium
Dynamic Require

Package source references dynamic require/import behavior.

skills/craft/uipm-design-system/scripts/generate-tokens.cjsView on unpkg · L9
skills/impeccable/scripts/live-svelte-component.mjsView file
20export function [redacted](filePath) { L21: if (/^(0|false|no)$/i.test(process.env.IMPECCABLE_LIVE_SVELTE_COMPONENT || '')) return false; L22: return path.extname(filePath).toLowerCase() === '.svelte'; ... L24: L25: export function componentSessionDir(id, cwd = process.cwd()) { L26: return path.join(cwd, SVELTE_COMPONENT_ROOT, id); ... L255: export function readManifest(manifestPath) { L256: const data = JSON.parse(fs.readFileSync(manifestPath, 'utf-8')); L257: return {
Low
Weak Crypto

Package source references weak cryptographic algorithms.

skills/impeccable/scripts/live-svelte-component.mjsView on unpkg · L20
skills/impeccable/scripts/live-server.mjsView file
15Cross-file remote execution chain: skills/impeccable/scripts/live-server.mjs spawns skills/impeccable/scripts/live-browser.js; helper contains network access plus dynamic code execution. L15: L16: import http from 'node:http'; L17: import { randomUUID } from 'node:crypto'; L18: import { spawn, execFileSync } from 'node:child_process'; L19: import fs from 'node:fs'; ... L50: L51: const __dirname = path.dirname(fileURLToPath(import.meta.url)); L52: // PRODUCT.md / DESIGN.md live wherever context.mjs resolves. The generated ... L103: const CHAT_POLL_FRESHNESS_MS = 60_000; L104: const APPLY_EVENT_HARD_TIMEOUT_MS = Number(process.env.IMPECCABLE_LIVE_APPLY_EVENT_HARD_TIMEOUT_MS || 150_000); L105: const APPLY_EVENT_SOFT_DEADLINE_MS = Number(process.env.IMPECCABLE_LIVE_APPLY_EVENT_SOFT_DEADLINE_MS || 120_000); ... L471: ok: false,
High
Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

skills/impeccable/scripts/live-server.mjsView on unpkg · L15
skills/craft/vercel-optimize/lib/vercel.mjsView file
15try { L16: const { stdout } = await exec("vercel", ["--version"]); L17: raw = stdout.trim(); ... L29: throw new Error( L30: `VERCEL_CLI_TOO_OLD: have ${v.join(".")}, need >= ${MIN_CLI_VERSION.join(".")}. Upgrade with \`npm i -g vercel@latest\`.`, L31: );
High
Runtime Package Install

Package source invokes a package manager install command at runtime.

skills/craft/vercel-optimize/lib/vercel.mjsView on unpkg · L15
skills/model-usage/scripts/test_model_usage.pyView file
•path = skills/model-usage/scripts/test_model_usage.py kind = build_helper sizeBytes = 1310 magicHex = [redacted]
Medium
Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/model-usage/scripts/test_model_usage.pyView on unpkg
skills/theme-factory/theme-showcase.pdfView file
•path = skills/theme-factory/theme-showcase.pdf kind = high_entropy_blob sizeBytes = 124310 magicHex = [redacted]
High
Ships High Entropy Blob

Package ships high-entropy non-source blobs.

skills/theme-factory/theme-showcase.pdfView on unpkg
skills/uipm-ui-styling/scripts/tests/test_shadcn_add.pyView file
•path = skills/uipm-ui-styling/scripts/tests/test_shadcn_add.py kind = payload_in_excluded_dir sizeBytes = 10186 magicHex = [redacted]
High
Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

skills/uipm-ui-styling/scripts/tests/test_shadcn_add.pyView on unpkg
skills/impeccable/scripts/live-copy-edit-agent.mjsView file
•matchType = previous_version_dangerous_delta matchedPackage = @oriro/orirocli@0.1.8 matchedIdentity = npm:QG9yaXJvL29yaXJvY2xp:0.1.8 similarity = 0.794 summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

skills/impeccable/scripts/live-copy-edit-agent.mjsView on unpkg
skills/graphify/skill-devin.mdView file
678patternName = generic_password severity = medium line = 678 matchedText = result =...ies)
Medium
Secret Pattern

Hardcoded password in skills/graphify/skill-devin.md

skills/graphify/skill-devin.mdView on unpkg · L678
skills/graphify/skill-aider.mdView file
561patternName = generic_password severity = medium line = 561 matchedText = result =...ies)
Medium
Secret Pattern

Hardcoded password in skills/graphify/skill-aider.md

skills/graphify/skill-aider.mdView on unpkg · L561

Findings

7 Critical6 High8 Medium8 Low
CriticalCritical Secretskills/technical/api-builder/SKILL.md
CriticalCredential Exfiltrationdist/cli.js
CriticalCommand Output Exfiltrationdist/cli.js
CriticalReverse Shelldist/cli.js
CriticalTrigger Reachable Dangerous Capabilitydist/cli.js
CriticalPrevious Version Dangerous Deltaskills/impeccable/scripts/live-copy-edit-agent.mjs
CriticalSecret Patternskills/technical/api-builder/SKILL.md
HighChild Processdist/cli.js
HighShelldist/cli.js
HighCross File Remote Execution Contextskills/impeccable/scripts/live-server.mjs
HighRuntime Package Installskills/craft/vercel-optimize/lib/vercel.mjs
HighShips High Entropy Blobskills/theme-factory/theme-showcase.pdf
HighPayload In Excluded Dirskills/uipm-ui-styling/scripts/tests/test_shadcn_add.py
MediumDynamic Requireskills/craft/uipm-design-system/scripts/generate-tokens.cjs
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/cli.js
MediumShips Build Helperskills/model-usage/scripts/test_model_usage.py
MediumStructural Risk Force Deep Review
MediumSecret Patternskills/graphify/skill-devin.md
MediumSecret Patternskills/graphify/skill-aider.md
LowNon Install Lifecycle Scripts
LowScripts Present
LowWeak Cryptoskills/impeccable/scripts/live-svelte-component.mjs
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
LowNo License