@ory/amp@1.2.1: AI-agent capability abuse – npm package flagged

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

This is not malicious install-time behavior, but it is an explicit-user-command mutation of an AI-agent control surface with broad tool coverage. It should be surfaced as a warning under the agent capability policy.

Static reason

No blocking static signals were detected.

Trigger

A user runs ory-amp install, ory-amp setup, or ory-amp-setup.

Impact

The configured Amp agent can invoke this package's delegate for tool decisions and load its project plugin.

Mechanism

Registers an all-tools delegate and writes Amp plugin and agent-skill configuration.

AI rationale

This is not malicious install-time behavior, but it is an explicit-user-command mutation of an AI-agent control surface with broad tool coverage. It should be surfaced as a warning under the agent capability policy.

Evidence

dist/cli/setup.jsdist/cli/assets.jsdist/permission.js~/.config/amp/settings.json<projectDir>/.amp/plugins/ory.ts<projectDir>/.agents/skills

Decision evidence

public snapshot

AI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

An explicit install command registers a delegate for every Amp tool in the user-global settings file.
The setup command writes a project Amp plugin loader and a tree of agent skills.
The delegate sends each tool name and arguments to the Ory client gate before allowing or rejecting it.

Evidence against

package.json contains no preinstall, install, or postinstall lifecycle hook.
The inspected package source contains no direct network request, shell execution, eval, or credential-file harvesting.
Configuration changes occur only through user-invoked CLI commands; no automatic install-time execution is present.

Behavioral surface

Source

EnvironmentVarsFilesystem

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 7 file(s), 37.0 KB of source, external domains: agents.console.ory.com

Source & flagged code

5 flagged

dist/cli/setup.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. nst to = typeof rec.to === "string" ? rec.to : ""; return to === "ory-amp-permission" || /ory-hook-amp\.(js|cjs|mjs)$/.test(to); } function mergepermissions(existing, to) { const merged = { ...existing }; const perms = (array.isarray(merged["amp.permissions"]) ? merged["amp.permissions"] : []).filter((e) => !isorydelegate(e)); perms.push(delegateentry(to)); merged["amp.permissions"] = perms; return merged; } function removepermissions(existing) { const merged = { ...existing };

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/cli/setup.jsView on unpkg

95function getSettingsPath(_args) { // Verified: Amp's default settings file is the user-global // ~/.config/amp/settings.json (the `--settings-file` default). Amp's own // permission entries are global by default; `-w/--workspace` would scope // them to the project. We follow the verified default. return path.join(os.homedir(), ".config", "amp", "settings.json"); }

Medium

Ai Review Evidence

An explicit install command registers a delegate for every Amp tool in the user-global settings file.

dist/cli/setup.jsView on unpkg · L95

208// (a) Register the permission delegate (blocking gate). const merged = mergePermissions(existing, runtime.hookShim); (0, argus_1.writeJsonFile)(settingsPath, merged); // (b) Write the in-process plugin loader (auth + activity auditing). fs.mkdirSync(path.dirname(pluginFile), { recursive: true }); fs.writeFileSync(pluginFile, pluginLoaderSource(runtime)); // (c) Materialize the Ory skill catalog. (0, assets_js_1.installAmpOryAssets)(args.projectDir);

Medium

Ai Review Evidence

The setup command writes a project Amp plugin loader and a tree of agent skills.

dist/cli/setup.jsView on unpkg · L208

dist/permission.jsView file

101async function decideToolPermission(input, client) { const toolName = extractToolName(input); const sessionId = extractSessionId(input); return (0, argus_1.withHookContext)(client, { sessionId }, async () => { client.logger.info("delegate.received", { toolName, sessionId }); try { // Amp rejects delegates that exceed ten seconds, so retain a shorter // local deadline that turns a hanging backend into an allow. const timeoutMs = resolveCheckTimeoutMs(); const raced = await raceCheckDeadline((0, argus_1.gate)(client, {

Medium

Ai Review Evidence

The delegate sends each tool name and arguments to the Ory client gate before allowing or rejecting it.

dist/permission.jsView on unpkg · L101

111harness: "amp", toolName, toolArgs: input.input ?? input.params ?? input.arguments ?? input.args, subjectFallback: sessionId ? `session:${sessionId}` : undefined, canBlock: true, }), timeoutMs);

Medium

Ai Review Evidence

The delegate sends each tool name and arguments to the Ory client gate before allowing or rejecting it.

dist/permission.jsView on unpkg · L111

Source & flagged code

5 flagged · loading source

dist/cli/setup.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. nst to = typeof rec.to === "string" ? rec.to : ""; return to === "ory-amp-permission" || /ory-hook-amp\.(js|cjs|mjs)$/.test(to); } function mergepermissions(existing, to) { const merged = { ...existing }; const perms = (array.isarray(merged["amp.permissions"]) ? merged["amp.permissions"] : []).filter((e) => !isorydelegate(e)); perms.push(delegateentry(to)); merged["amp.permissions"] = perms; return merged; } function removepermissions(existing) { const merged = { ...existing };

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/cli/setup.jsView on unpkg

95function getSettingsPath(_args) { // Verified: Amp's default settings file is the user-global // ~/.config/amp/settings.json (the `--settings-file` default). Amp's own // permission entries are global by default; `-w/--workspace` would scope // them to the project. We follow the verified default. return path.join(os.homedir(), ".config", "amp", "settings.json"); }

Medium

Ai Review Evidence

An explicit install command registers a delegate for every Amp tool in the user-global settings file.

dist/cli/setup.jsView on unpkg · L95

Findings

1 High5 Medium4 Low

HighTrigger Reachable External Ai Agent Control Surface Mutationdist/cli/setup.js

MediumEnvironment Vars

MediumAi Review Evidencedist/cli/setup.js

MediumAi Review Evidencedist/permission.js

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Behavioral surface

Source & flagged code