registry / AI-agent capability abuse / @ory/amp / 1.2.0

@ory/amp@1.2.0

Ory plugin for Amp (Sourcegraph's coding agent): a permission delegate that authorizes every tool call plus an in-process plugin for session auth and activity auditing

AI Security Review

scanned 12d ago · by lpm-firewall-ai

The inspected configuration changes are substantial but are activated through an explicit user command and are aligned with the package's Ory plugin purpose. No malicious behavior or automatic install-time mutation was established, so this warrants a warning rather than a block.

Static reason

No blocking static signals were detected.

Trigger

A user runs the package's setup binary or invokes the main CLI with the install command.

Impact

Amp tool decisions pass through the configured Ory delegate, and Amp loads the Ory plugin for authentication and activity auditing.

Mechanism

The command writes a global Amp permission entry that delegates every tool to the Ory helper and writes a plugin loader under the project configuration directory.

AI rationale

Evidence

package.jsondist/cli/setup.jsdist/cli/main.js~/.config/amp/settings.json.amp/plugins/ory.ts

Decision evidence

public snapshot

AI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The package exposes setup and permission tools as user-invoked command-line binaries.
The setup command adds a delegate for every Amp tool and writes the plugin loader into the project configuration.
The main CLI runs setup only for an explicit install command; package.json has no install lifecycle hook.

Evidence against

Setup routes through the package's Ory permission helper and describes its plugin as handling session authentication and activity auditing.
The inspected setup path does not show an external network endpoint or credential exfiltration.

Behavioral surface

Source

EnvironmentVarsFilesystem

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 7 file(s), 37.0 KB of source, external domains: agents.console.ory.com

Source & flagged code

5 flagged

dist/cli/setup.jsView file

Lines 93-133javascript

93 });

94}

95function getSettingsPath(_args) {

96 // Verified: Amp's default settings file is the user-global

97 // ~/.config/amp/settings.json (the `--settings-file` default). Amp's own

98 // permission entries are global by default; `-w/--workspace` would scope

99 // them to the project. We follow the verified default.

100 return path.join(os.homedir(), ".config", "amp", "settings.json");

101}

102/**

103 * The `amp.permissions` delegate entry that routes every tool ("*") through

104 * the Ory permission helper. Amp invokes the named program with the tool

105 * params on stdin and reads the decision from the exit code.

106 *

107 * Verified against the binary: a flat top-level `amp.permissions` array of

108 * `{ tool, action, to }` entries, and `to` accepts an **absolute path** — its

109 * help text says the helper "must be on $PATH", but a path works and is what

110 * we write. That matters beyond consistency: a bare bin name only resolves

111 * from a shell-initialized PATH, which a GUI-launched Amp does not have.

112 */

113function delegateEntry(to) {

114 return { tool: "*", action: "delegate", to };

115}

116function isOryDelegate(entry) {

117 if (typeof entry !== "object" || entry === null)

118 return false;

Medium

Ai Review Evidence

The setup command adds a delegate for every Amp tool and writes the plugin loader into the project configuration.

dist/cli/setup.jsView on unpkg · L113

119 const rec = entry;

120 if (rec.action !== "delegate")

121 return false;

122 const to = typeof rec.to === "string" ? rec.to : "";

123 // Match the shim we write now and the bare bin name earlier releases wrote,

124 // so an install replaces a stale entry instead of leaving both in place.

125 return to === "ory-amp-permission" || /ory-hook-amp\.(js|cjs|mjs)$/.test(to);

126}

127function mergePermissions(existing, to) {

128 const merged = { ...existing };

129 const perms = (Array.isArray(merged["amp.permissions"])

130 ? merged["amp.permissions"]

131 : []).filter((e) => !isOryDelegate(e));

132 perms.push(delegateEntry(to));

133 merged["amp.permissions"] = perms;

Lines 188-228javascript

188 }

189 if (fs.existsSync(pluginFile)) {

190 fs.rmSync(pluginFile, { force: true });

191 console.log(`Removed Ory in-process plugin from ${pluginFile}`);

192 }

193 (0, assets_js_1.uninstallAmpOryAssets)(args.projectDir);

194

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. nst to = typeof rec.to === "string" ? rec.to : ""; return to === "ory-amp-permission" || /ory-hook-amp\.(js|cjs|mjs)$/.test(to); } function mergepermissions(existing, to) { const merged = { ...existing }; const perms = (array.isarray(merged["amp.permissions"]) ? merged["amp.permissions"] : []).filter((e) => !isorydelegate(e)); perms.push(delegateentry(to)); merged["amp.permissions"] = perms; return merged; } function removepermissions(existing) { const merged = { ...existing };

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/cli/setup.jsView on unpkg

package.jsonView file

Lines 42-82json

42 "keto",

43 "hydra"

44 ],

45 "publishConfig": {

46 "access": "public",

47 "registry": "https://registry.npmjs.org/",

dist/cli/main.jsView file

Lines 39-79javascript

39 if (mod && mod.__esModule) return mod;

40 var result = {};

41 if (mod != null) for (var k = ownKeys

Source & flagged code

5 flagged · loading source

dist/cli/setup.jsView file

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/cli/setup.jsView on unpkg

208// (a) Register the permission delegate (blocking gate). const merged = mergePermissions(existing, runtime.hookShim); (0, argus_1.writeJsonFile)(settingsPath, merged); // (b) Write the in-process plugin loader (auth + activity auditing). fs.mkdirSync

Medium

Ai Review Evidence

The setup command adds a delegate for every Amp tool and writes the plugin loader into the project configuration.

dist/cli/setup.jsView on unpkg · L208

Findings

1 High5 Medium4 Low

HighTrigger Reachable External Ai Agent Control Surface Mutationdist/cli/setup.js

MediumEnvironment Vars

MediumAi Review Evidencepackage.json

MediumAi Review Evidencedist/cli/setup.js

MediumSuspicious Lifecycle Evidencedist/cli/main.js

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @ory/amp@1.2.0.

See all versions of @ory/amp for other recorded verdicts.

Review the evidence and your use of @ory/amp@1.2.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-11 04:27:18.536Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.