@ory/amp@1.0.0
Ory plugin for Amp (Sourcegraph's coding agent): a permission delegate that authorizes every tool call plus an in-process plugin for session auth and activity auditing
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is an explicit-user-command Amp integration with broad agent-control and activity-handling capability. Source inspection found no automatic lifecycle trigger or concrete malicious chain, so it should warn rather than block.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Trigger
The user runs ory-amp install, ory-amp setup, or the setup binary.
Impact
The package gains control over the configured Amp agent's tool-call authorization and receives tool inputs and outputs through its client integration.
Mechanism
Explicit CLI installation of an Amp permission delegate and in-process plugin.
AI rationale
This is an explicit-user-command Amp integration with broad agent-control and activity-handling capability. Source inspection found no automatic lifecycle trigger or concrete malicious chain, so it should warn rather than block.
Evidence
package.jsondist/cli/main.jsdist/cli/setup.jsdist/plugin.jsdist/permission.js~/.config/amp/settings.json<projectDir>/.amp/plugins/ory.ts<projectDir>/.agents/skills
Decision evidence
public snapshotAI called this Suspicious at 87.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The explicit install command registers a delegate for every Amp tool in the user-global settings file.
- Setup writes an executable Amp plugin loader into the selected project's .amp/plugins directory.
- The installed plugin intercepts tool calls and results and passes tool input and output to its Ory client dependency.
- The delegate can reject tool calls based on the Ory client decision.
Evidence against
- package.json has no preinstall, install, or postinstall lifecycle hook.
- The control-surface writes occur only after an explicit CLI install or setup command.
- The manifest has no dependency on @ory/amp itself.
- No direct credential harvesting, shell execution, destructive project-wide operation, or hard-coded exfiltration endpoint appears in this package source.
Behavioral surface
EnvironmentVarsFilesystem
HighEntropyStringsUrlStrings
Source & flagged code
5 flagged · loading sourcedist/cli/setup.jsView file
•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation.
nst to = typeof rec.to === "string" ? rec.to : "";
return to === "ory-amp-permission" || /ory-hook-amp\.(js|cjs|mjs)$/.test(to);
}
function mergepermissions(existing, to) {
const merged = { ...existing };
const perms = (array.isarray(merged["amp.permissions"])
? merged["amp.permissions"]
: []).filter((e) => !isorydelegate(e));
perms.push(delegateentry(to));
merged["amp.permissions"] = perms;
return merged;
}
function removepermissions(existing) {
const merged = { ...existing };
High
Trigger Reachable External Ai Agent Control Surface Mutation
Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.
dist/cli/setup.jsView on unpkg95function getSettingsPath(_args) {
// Verified: Amp's default settings file is the user-global
// ~/.config/amp/settings.json (the `--settings-file` default). Amp's own
// permission entries are global by default; `-w/--workspace` would scope
// them to the project. We follow the verified default.
return path.join(os.homedir(), ".config", "amp", "settings.json");
Medium
Ai Review Evidence
The explicit install command registers a delegate for every Amp tool in the user-global settings file.
dist/cli/setup.jsView on unpkg · L95Findings
2 High4 Medium4 Low
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/cli/setup.js
HighPrevious Version Dangerous Deltadist/cli/main.js
MediumEnvironment Vars
MediumAi Review Evidencedist/cli/setup.js
MediumAi Review Evidencedist/cli/setup.js
MediumSuspicious Dependency Evidencedist/plugin.js
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @ory/amp@1.0.0.
See all versions of @ory/amp for other recorded verdicts.
- Review the evidence and your use of @ory/amp@1.0.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.