@ory/amp@1.2.3
Ory plugin for Amp (Sourcegraph's coding agent): a permission delegate that authorizes every tool call plus an in-process plugin for session auth and activity auditing
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe package has an explicit-user-command agent-control surface, not an automatic install-time attack chain. Its source has no lifecycle hook or direct malicious execution primitive, so the risk warrants a warning rather than a block.
Static reason
No blocking static signals were detected.
Trigger
The user runs ory-amp install, ory-amp setup, or the ory-amp-setup binary.
Impact
The configured Ory runtime can observe or reject Amp tool calls and supply project skills.
Mechanism
Writes an all-tools permission delegate and project agent-extension files.
AI rationale
The package has an explicit-user-command agent-control surface, not an automatic install-time attack chain. Its source has no lifecycle hook or direct malicious execution primitive, so the risk warrants a warning rather than a block.
Evidence
dist/cli/setup.jsdist/cli/assets.jsdist/permission.js~/.config/amp/settings.json<projectDir>/.amp/plugins/ory.ts<projectDir>/.agents/skills/
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The explicit setup CLI writes a global Amp permission rule that delegates every tool call to an Ory runtime shim.
- The same command creates a project plugin loader and an Ory skill tree that Amp can load.
- The permission helper receives tool arguments and can reject tool calls through Amp's delegate exit-code mechanism.
Evidence against
- package.json has no preinstall, install, or postinstall hook.
- The control-surface writes occur only through explicit install or setup CLI commands.
- No direct network client, shell execution, eval, or credential harvesting exists in this package's own source.
Behavioral surface
EnvironmentVarsFilesystem
HighEntropyStringsUrlStrings
Source & flagged code
5 flagged · loading sourcedist/cli/setup.jsView file
•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation.
nst to = typeof rec.to === "string" ? rec.to : "";
return to === "ory-amp-permission" || /ory-hook-amp\.(js|cjs|mjs)$/.test(to);
}
function mergepermissions(existing, to) {
const merged = { ...existing };
const perms = (array.isarray(merged["amp.permissions"])
? merged["amp.permissions"]
: []).filter((e) => !isorydelegate(e));
perms.push(delegateentry(to));
merged["amp.permissions"] = perms;
return merged;
}
function removepermissions(existing) {
const merged = { ...existing };
High
Trigger Reachable External Ai Agent Control Surface Mutation
Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.
dist/cli/setup.jsView on unpkg208// (a) Register the permission delegate (blocking gate).
const merged = mergePermissions(existing, runtime.hookShim);
(0, argus_1.writeJsonFile)(settingsPath, merged);
// (b) Write the in-process plugin loader (auth + activity auditing).
fs.mkdirSync(path.dirname(pluginFile), { recursive: true });
fs.writeFileSync(pluginFile, pluginLoaderSource(runtime));
Medium
Ai Review Evidence
The explicit setup CLI writes a global Amp permission rule that delegates every tool call to an Ory runtime shim.
dist/cli/setup.jsView on unpkg · L208Findings
1 High5 Medium4 Low
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/cli/setup.js
MediumEnvironment Vars
MediumAi Review Evidencedist/cli/setup.js
MediumAi Review Evidencedist/cli/assets.js
MediumAi Review Evidencedist/permission.js
MediumAi Review Evidencepackage.json
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @ory/amp@1.2.3.
See all versions of @ory/amp for other recorded verdicts.
- Review the evidence and your use of @ory/amp@1.2.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.