AI Security Review
scanned 2h ago · by lpm-firewall-aiNo confirmed malicious install-time or import-time behavior was found. Runtime capabilities are those of an interactive AI agent CLI and are user-invoked, with Guardian rules intended to detect dangerous shell/network patterns.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
User runs `oriro` CLI commands such as setup, connectors, channels, agents, head, or router configuration.
Impact
No concrete unconsented exfiltration, persistence, destructive action, or AI-agent control-surface hijack established by static inspection.
Mechanism
User-invoked AI agent CLI with local state, optional scheduler setup, model/router network calls, and guarded tool execution.
Rationale
The high-risk scanner matches in dist/cli.js are primarily security-detection regexes and documented, explicit CLI features rather than hidden malware. The package has no install hook and no source-grounded evidence of unconsented credential harvesting, exfiltration, remote payload execution, or stealth persistence.
Evidence
package.jsondist/cli.jsskills/craft/uipm-design-system/scripts/generate-tokens.cjsskills/technical/api-builder/SKILL.md~/.oriroAGENTS.md
Network endpoints5
discord.com/api/v10/users/@metext.pollinations.ai/openaioriro.aioriro.ai/api/race/gaussoriro.ai/api/race/avila
Decision evidence
public snapshotAI called this Clean at 86.0% confidence as Benign with medium false-positive risk.
Evidence for block
- dist/cli.js has explicit user commands that can fetch/import agent definitions from a URL and run saved agents.
- dist/cli.js has an optional `agents cron --apply` command that writes an OS scheduler entry.
- dist/cli.js ships many network-capable integrations and model/router endpoints.
Evidence against
- package.json has no preinstall/install/postinstall hook; only prepublishOnly build/test/smoke.
- dist/cli.js scanner reverse-shell/exfil hits are Guardian regex rules that block such commands, not executed attack code.
- dist/cli.js network endpoints are user-selected routers/channels/connectors or ORIRO assets, not hidden exfil sinks.
- dist/cli.js writes state under ~/.oriro and project AGENTS.md only via explicit CLI/chat commands.
- skills/craft/uipm-design-system/scripts/generate-tokens.cjs only reads a token JSON and writes generated CSS/Tailwind output when invoked.
- skills/technical/api-builder/SKILL.md contains example API key/JWT text, not an active secret or code path.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsMinifiedTelemetryUrlStrings
NoLicense
Source & flagged code
17 flagged · loading sourceskills/technical/api-builder/SKILL.mdView file
94patternName = supabase_service_key
severity = critical
line = 94
matchedText = eyJhbGci...sw5c
Critical
Critical Secret
Package contains a critical-looking secret pattern.
skills/technical/api-builder/SKILL.mdView on unpkg · L9494patternName = supabase_service_key
severity = critical
line = 94
matchedText = eyJhbGci...sw5c
Critical
Secret Pattern
Supabase service role key (JWT) in skills/technical/api-builder/SKILL.md
skills/technical/api-builder/SKILL.mdView on unpkg · L94dist/cli.jsView file
69function oriroDir() {
L70: return process.env.ORIRO_STATE_DIR ?? join(homedir(), ".oriro");
L71: }
...
L139: ["ioc:obf_loader", /eval\(\s*(atob|Buffer\.from)\(/i],
L140: ["ioc:cp_loader", /child_process[\s\S]{0,40}(atob|fromCharCode)/i]
L141: ];
...
L218: stripQuotes = (t) => t.replace(/^['"]+/, "").replace(/['"]+$/, "");
L219: SYS_DIR = "(etc|usr|bin|sbin|var|boot|lib|lib64|sys|proc|dev|root|opt|windows|system32|programdata|library|applications|system|private|cores|volumes|network)";
L220: DISK = "(sd|nvme|disk|hd|vd|xvd|mmcblk|loop)";
...
L274: /\b(nc|ncat|netcat)\b[^\n]*\s-[a-z]*e\b/i,
L275: // nc/ncat -e
L276: /\b(ncat|socat)\b[^\n]*exec[: ]/i,
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/cli.jsView on unpkg · L6969function oriroDir() {
L70: return process.env.ORIRO_STATE_DIR ?? join(homedir(), ".oriro");
L71: }
...
L139: ["ioc:obf_loader", /eval\(\s*(atob|Buffer\.from)\(/i],
L140: ["ioc:cp_loader", /child_process[\s\S]{0,40}(atob|fromCharCode)/i]
L141: ];
...
L218: stripQuotes = (t) => t.replace(/^['"]+/, "").replace(/['"]+$/, "");
L219: SYS_DIR = "(etc|usr|bin|sbin|var|boot|lib|lib64|sys|proc|dev|root|opt|windows|system32|programdata|library|applications|system|private|cores|volumes|network)";
L220: DISK = "(sd|nvme|disk|hd|vd|xvd|mmcblk|loop)";
...
L274: /\b(nc|ncat|netcat)\b[^\n]*\s-[a-z]*e\b/i,
L275: // nc/ncat -e
L276: /\b(ncat|socat)\b[^\n]*exec[: ]/i,
Critical
Command Output Exfiltration
Source executes local commands and sends command output to an external endpoint.
dist/cli.jsView on unpkg · L6969function oriroDir() {
L70: return process.env.ORIRO_STATE_DIR ?? join(homedir(), ".oriro");
L71: }
...
L139: ["ioc:obf_loader", /eval\(\s*(atob|Buffer\.from)\(/i],
L140: ["ioc:cp_loader", /child_process[\s\S]{0,40}(atob|fromCharCode)/i]
L141: ];
...
L218: stripQuotes = (t) => t.replace(/^['"]+/, "").replace(/['"]+$/, "");
L219: SYS_DIR = "(etc|usr|bin|sbin|var|boot|lib|lib64|sys|proc|dev|root|opt|windows|system32|programdata|library|applications|system|private|cores|volumes|network)";
L220: DISK = "(sd|nvme|disk|hd|vd|xvd|mmcblk|loop)";
...
L274: /\b(nc|ncat|netcat)\b[^\n]*\s-[a-z]*e\b/i,
L275: // nc/ncat -e
L276: /\b(ncat|socat)\b[^\n]*exec[: ]/i,
Critical
Reverse Shell
Source matches reverse-shell style process and socket wiring.
dist/cli.jsView on unpkg · L6969Trigger-reachable chain: manifest.bin -> dist/cli.js
L69: function oriroDir() {
L70: return process.env.ORIRO_STATE_DIR ?? join(homedir(), ".oriro");
L71: }
...
L139: ["ioc:obf_loader", /eval\(\s*(atob|Buffer\.from)\(/i],
L140: ["ioc:cp_loader", /child_process[\s\S]{0,40}(atob|fromCharCode)/i]
L141: ];
...
L218: stripQuotes = (t) => t.replace(/^['"]+/, "").replace(/['"]+$/, "");
L219: SYS_DIR = "(etc|usr|bin|sbin|var|boot|lib|lib64|sys|proc|dev|root|opt|windows|system32|programdata|library|applications|system|private|cores|volumes|network)";
L220: DISK = "(sd|nvme|disk|hd|vd|xvd|mmcblk|loop)";
...
L274: /\b(nc|ncat|netcat)\b[^\n]*\s-[a-z]*e\b/i,
L275: // nc/ncat -e
L276: /\b(ncat|socat)\b[^\n]*exec[: ]/i,
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/cli.jsView on unpkg · L69139["ioc:obf_loader", /eval\(\s*(atob|Buffer\.from)\(/i],
L140: ["ioc:cp_loader", /child_process[\s\S]{0,40}(atob|fromCharCode)/i]
L141: ];
High
254new RegExp(`\\b(bash|sh|zsh|ksh|eval)\\b[^\\n]*\\$\\(\\s*${FETCH}\\b`, "i"),
L255: // bash -c "$(curl)"
L256: new RegExp(`\\$\\(\\s*${FETCH}\\b[^)]*\\)`, "i"),
High
69function oriroDir() {
L70: return process.env.ORIRO_STATE_DIR ?? join(homedir(), ".oriro");
L71: }
...
L139: ["ioc:obf_loader", /eval\(\s*(atob|Buffer\.from)\(/i],
L140: ["ioc:cp_loader", /child_process[\s\S]{0,40}(atob|fromCharCode)/i]
L141: ];
...
L218: stripQuotes = (t) => t.replace(/^['"]+/, "").replace(/['"]+$/, "");
L219: SYS_DIR = "(etc|usr|bin|sbin|var|boot|lib|lib64|sys|proc|dev|root|opt|windows|system32|programdata|library|applications|system|private|cores|volumes|network)";
L220: DISK = "(sd|nvme|disk|hd|vd|xvd|mmcblk|loop)";
...
L274: /\b(nc|ncat|netcat)\b[^\n]*\s-[a-z]*e\b/i,
L275: // nc/ncat -e
L276: /\b(ncat|socat)\b[^\n]*exec[: ]/i,
High
Cloud Metadata Access
Source reaches cloud instance metadata or link-local credential endpoints.
dist/cli.jsView on unpkg · L6969function oriroDir() {
L70: return process.env.ORIRO_STATE_DIR ?? join(homedir(), ".oriro");
L71: }
...
L139: ["ioc:obf_loader", /eval\(\s*(atob|Buffer\.from)\(/i],
L140: ["ioc:cp_loader", /child_process[\s\S]{0,40}(atob|fromCharCode)/i]
L141: ];
...
L218: stripQuotes = (t) => t.replace(/^['"]+/, "").replace(/['"]+$/, "");
L219: SYS_DIR = "(etc|usr|bin|sbin|var|boot|lib|lib64|sys|proc|dev|root|opt|windows|system32|programdata|library|applications|system|private|cores|volumes|network)";
L220: DISK = "(sd|nvme|disk|hd|vd|xvd|mmcblk|loop)";
...
L274: /\b(nc|ncat|netcat)\b[^\n]*\s-[a-z]*e\b/i,
L275: // nc/ncat -e
L276: /\b(ncat|socat)\b[^\n]*exec[: ]/i,
Medium
Install Persistence
Source writes installer persistence such as shell profile or service configuration.
dist/cli.jsView on unpkg · L69skills/craft/uipm-design-system/scripts/generate-tokens.cjsView file
9L10: const fs = require("fs");
L11: const path = require("path");
Medium
Dynamic Require
Package source references dynamic require/import behavior.
skills/craft/uipm-design-system/scripts/generate-tokens.cjsView on unpkg · L9skills/impeccable/scripts/live-svelte-component.mjsView file
20export function [redacted](filePath) {
L21: if (/^(0|false|no)$/i.test(process.env.IMPECCABLE_LIVE_SVELTE_COMPONENT || '')) return false;
L22: return path.extname(filePath).toLowerCase() === '.svelte';
...
L24:
L25: export function componentSessionDir(id, cwd = process.cwd()) {
L26: return path.join(cwd, SVELTE_COMPONENT_ROOT, id);
...
L255: export function readManifest(manifestPath) {
L256: const data = JSON.parse(fs.readFileSync(manifestPath, 'utf-8'));
L257: return {
Low
Weak Crypto
Package source references weak cryptographic algorithms.
skills/impeccable/scripts/live-svelte-component.mjsView on unpkg · L20skills/impeccable/scripts/live-server.mjsView file
15Cross-file remote execution chain: skills/impeccable/scripts/live-server.mjs spawns skills/impeccable/scripts/live-browser.js; helper contains network access plus dynamic code execution.
L15:
L16: import http from 'node:http';
L17: import { randomUUID } from 'node:crypto';
L18: import { spawn, execFileSync } from 'node:child_process';
L19: import fs from 'node:fs';
...
L50:
L51: const __dirname = path.dirname(fileURLToPath(import.meta.url));
L52: // PRODUCT.md / DESIGN.md live wherever context.mjs resolves. The generated
...
L103: const CHAT_POLL_FRESHNESS_MS = 60_000;
L104: const APPLY_EVENT_HARD_TIMEOUT_MS = Number(process.env.IMPECCABLE_LIVE_APPLY_EVENT_HARD_TIMEOUT_MS || 150_000);
L105: const APPLY_EVENT_SOFT_DEADLINE_MS = Number(process.env.IMPECCABLE_LIVE_APPLY_EVENT_SOFT_DEADLINE_MS || 120_000);
...
L471: ok: false,
High
Cross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
skills/impeccable/scripts/live-server.mjsView on unpkg · L15skills/craft/vercel-optimize/lib/vercel.mjsView file
15try {
L16: const { stdout } = await exec("vercel", ["--version"]);
L17: raw = stdout.trim();
...
L29: throw new Error(
L30: `VERCEL_CLI_TOO_OLD: have ${v.join(".")}, need >= ${MIN_CLI_VERSION.join(".")}. Upgrade with \`npm i -g vercel@latest\`.`,
L31: );
High
Runtime Package Install
Package source invokes a package manager install command at runtime.
skills/craft/vercel-optimize/lib/vercel.mjsView on unpkg · L15skills/model-usage/scripts/test_model_usage.pyView file
•path = skills/model-usage/scripts/test_model_usage.py
kind = build_helper
sizeBytes = 1310
magicHex = [redacted]
Medium
Ships Build Helper
Package ships non-JavaScript build or shell helper files.
skills/model-usage/scripts/test_model_usage.pyView on unpkgskills/theme-factory/theme-showcase.pdfView file
•path = skills/theme-factory/theme-showcase.pdf
kind = high_entropy_blob
sizeBytes = 124310
magicHex = [redacted]
High
Ships High Entropy Blob
Package ships high-entropy non-source blobs.
skills/theme-factory/theme-showcase.pdfView on unpkgskills/uipm-ui-styling/scripts/tests/test_shadcn_add.pyView file
•path = skills/uipm-ui-styling/scripts/tests/test_shadcn_add.py
kind = payload_in_excluded_dir
sizeBytes = 10186
magicHex = [redacted]
High
Payload In Excluded Dir
Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.
skills/uipm-ui-styling/scripts/tests/test_shadcn_add.pyView on unpkgFindings
6 Critical7 High6 Medium8 Low
CriticalCritical Secretskills/technical/api-builder/SKILL.md
CriticalCredential Exfiltrationdist/cli.js
CriticalCommand Output Exfiltrationdist/cli.js
CriticalReverse Shelldist/cli.js
CriticalTrigger Reachable Dangerous Capabilitydist/cli.js
CriticalSecret Patternskills/technical/api-builder/SKILL.md
HighChild Processdist/cli.js
HighShelldist/cli.js
HighCloud Metadata Accessdist/cli.js
HighCross File Remote Execution Contextskills/impeccable/scripts/live-server.mjs
HighRuntime Package Installskills/craft/vercel-optimize/lib/vercel.mjs
HighShips High Entropy Blobskills/theme-factory/theme-showcase.pdf
HighPayload In Excluded Dirskills/uipm-ui-styling/scripts/tests/test_shadcn_add.py
MediumDynamic Requireskills/craft/uipm-design-system/scripts/generate-tokens.cjs
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/cli.js
MediumShips Build Helperskills/model-usage/scripts/test_model_usage.py
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowWeak Cryptoskills/impeccable/scripts/live-svelte-component.mjs
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
LowNo License