@ory/amp@1.2.2
Ory plugin for Amp (Sourcegraph's coding agent): a permission delegate that authorizes every tool call plus an in-process plugin for session auth and activity auditing
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe source establishes an explicit, broad Amp control-surface mutation but no automatic installation trigger or concrete malicious behavior. This warrants a warning for dangerous agent capability rather than a publish block.
Static reason
No blocking static signals were detected.
Trigger
The user runs ory-amp install, ory-amp setup, or ory-amp-setup.
Impact
The configured Amp instance will execute the package's permission delegate and import its plugin for future agent sessions.
Mechanism
Writes an all-tools Amp permission delegate and project plugin loader.
AI rationale
The source establishes an explicit, broad Amp control-surface mutation but no automatic installation trigger or concrete malicious behavior. This warrants a warning for dangerous agent capability rather than a publish block.
Evidence
dist/cli/main.jsdist/cli/setup.js~/.config/amp/settings.json<projectDir>/.amp/plugins/ory.ts<projectDir>/.agents/skills
Decision evidence
public snapshotAI called this Suspicious at 93.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The package exposes explicit install and setup commands that load the setup writer.
- The setup command changes Amp's global permission configuration to delegate every tool call and writes an in-process project plugin loader.
- Setup supplies an npx command for the same package to its runtime-wiring helper, but this occurs only after the user invokes setup.
Evidence against
- package.json has no preinstall, install, or postinstall lifecycle hook.
- The control-surface changes are reached only through an explicit CLI command, not package installation or import.
- No secret harvesting, shell execution, destructive behavior, or direct network client is present in the inspected package source.
Behavioral surface
EnvironmentVarsFilesystem
HighEntropyStringsUrlStrings
Source & flagged code
5 flagged · loading sourcedist/cli/setup.jsView file
•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation.
nst to = typeof rec.to === "string" ? rec.to : "";
return to === "ory-amp-permission" || /ory-hook-amp\.(js|cjs|mjs)$/.test(to);
}
function mergepermissions(existing, to) {
const merged = { ...existing };
const perms = (array.isarray(merged["amp.permissions"])
? merged["amp.permissions"]
: []).filter((e) => !isorydelegate(e));
perms.push(delegateentry(to));
merged["amp.permissions"] = perms;
return merged;
}
function removepermissions(existing) {
const merged = { ...existing };
High
Trigger Reachable External Ai Agent Control Surface Mutation
Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.
dist/cli/setup.jsView on unpkg208// (a) Register the permission delegate (blocking gate).
const merged = mergePermissions(existing, runtime.hookShim);
(0, argus_1.writeJsonFile)(settingsPath, merged);
// (b) Write the in-process plugin loader (auth + activity auditing).
fs.mkdirSync(path.dirname(pluginFile), { recursive: true });
fs.writeFileSync(pluginFile, pluginLoaderSource(runtime));
Medium
Ai Review Evidence
The setup command changes Amp's global permission configuration to delegate every tool call and writes an in-process project plugin loader.
dist/cli/setup.jsFindings
1 High5 Medium4 Low
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/cli/setup.js
MediumEnvironment Vars
MediumAi Review Evidencepackage.json
MediumAi Review Evidencedist/cli/main.js
MediumAi Review Evidencedist/cli/setup.js
MediumAi Review Evidencedist/cli/setup.js
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @ory/amp@1.2.2.
See all versions of @ory/amp for other recorded verdicts.
- Review the evidence and your use of @ory/amp@1.2.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.