registry / AI-agent capability abuse / @ory/amp / 1.1.0

@ory/amp@1.1.0

Ory plugin for Amp (Sourcegraph's coding agent): a permission delegate that authorizes every tool call plus an in-process plugin for session auth and activity auditing

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

This is an explicit-user-command agent configuration mutator with broad tool interception, so it warrants a warning. It is not malicious because no automatic lifecycle execution or concrete harmful behavior was found.

Static reason

No blocking static signals were detected.

Trigger

The user runs ory-amp install, ory-amp setup, or ory-amp-setup.

Impact

Future Amp sessions can execute the Ory delegate for every tool call and load the Ory plugin, which processes tool inputs and outputs.

Mechanism

Explicit CLI mutation of Amp permissions and plugin discovery paths.

AI rationale

Evidence

dist/cli/main.jsdist/cli/setup.jsdist/cli/assets.jsdist/plugin.js~/.config/amp/settings.json<projectDir>/.amp/plugins/ory.ts<projectDir>/.agents/skills

Decision evidence

public snapshot

AI called this Suspicious at 88.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

An explicit setup command modifies Amp's user-global permission settings.
The setup installs a delegate for every Amp tool call and points it to an Ory runtime shim.
The same command writes an executable plugin loader and an Ory skill catalog into the selected project.
The loaded plugin sends tool inputs and outputs to the Ory client for activity completion.

Evidence against

package.json has no preinstall, install, postinstall, or prepare lifecycle hook.
The control-surface changes require an explicit CLI install or setup command.
No self-dependency, shell execution, obfuscation, credential harvesting, or direct exfiltration code was found in this package.

Behavioral surface

Source

EnvironmentVarsFilesystem

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 7 file(s), 37.0 KB of source, external domains: agents.console.ory.com

Source & flagged code

6 flagged

dist/cli/setup.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. nst to = typeof rec.to === "string" ? rec.to : ""; return to === "ory-amp-permission" || /ory-hook-amp\.(js|cjs|mjs)$/.test(to); } function mergepermissions(existing, to) { const merged = { ...existing }; const perms = (array.isarray(merged["amp.permissions"]) ? merged["amp.permissions"] : []).filter((e) => !isorydelegate(e)); perms.push(delegateentry(to)); merged["amp.permissions"] = perms; return merged; } function removepermissions(existing) { const merged = { ...existing };

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/cli/setup.jsView on unpkg

100return path.join(os.homedir(), ".config", "amp", "settings.json");

Medium

Ai Review Evidence

The setup installs a delegate for every Amp tool call and points it to an Ory runtime shim.

dist/cli/setup.jsView on unpkg · L100

113function delegateEntry(to) { return { tool: "*", action: "delegate", to }; }

Medium

Ai Review Evidence

The setup installs a delegate for every Amp tool call and points it to an Ory runtime shim.

dist/cli/setup.jsView on unpkg · L113

208// (a) Register the permission delegate (blocking gate). const merged = mergePermissions(existing, runtime.hookShim); (0, argus_1.writeJsonFile)(settingsPath, merged); // (b) Write the in-process plugin loader (auth + activity auditing). fs.mkdirSync(path.dirname(pluginFile), { recursive: true }); fs.writeFileSync(pluginFile, pluginLoaderSource(runtime)); // (c) Materialize the Ory skill catalog. (0, assets_js_1.installAmpOryAssets)(args.projectDir);

Medium

Ai Review Evidence

The same command writes an executable plugin loader and an Ory skill catalog into the selected project.

dist/cli/setup.jsView on unpkg · L208

package.jsonView file

Lines 42-82json

42 "keto",

43 "hydra"

44 ],

45 "publishConfig": {

46 "access": "public",

47 "registry": "https://registry.npmjs.org/",

dist/plugin.jsView file

Lines 31-63javascript

31function createToolCallHandler(client) {

32 return async (event) => {

33 const decision = await (0, permission_js_1.decideToolPermission)({ tool: event.tool, input: event.input, threadID: event.thread.id }, client);

Source & flagged code

6 flagged · loading source

dist/cli/setup.jsView file

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/cli/setup.jsView on unpkg

100return path.join(os.homedir(), ".config", "amp", "settings.json");

Medium

Ai Review Evidence

The setup installs a delegate for every Amp tool call and points it to an Ory runtime shim.

dist/cli/setup.jsView on unpkg · L100

113function delegateEntry(to) { return { tool: "*", action: "delegate", to }; }

Findings

1 High6 Medium4 Low

HighTrigger Reachable External Ai Agent Control Surface Mutationdist/cli/setup.js

MediumEnvironment Vars

MediumAi Review Evidencepackage.json

MediumAi Review Evidencedist/cli/setup.js

MediumAi Review Evidencedist/plugin.js

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @ory/amp@1.1.0.

See all versions of @ory/amp for other recorded verdicts.

Review the evidence and your use of @ory/amp@1.1.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-04 14:56:47.356Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.