registry / AI-agent capability abuse / @ory/amp / 1.2.4

@ory/amp@1.2.4

Ory plugin for Amp (Sourcegraph's coding agent): a permission delegate that authorizes every tool call plus an in-process plugin for session auth and activity auditing

AI Security Review

scanned 12d ago · by lpm-firewall-ai

The manifest exposes setup as a CLI and declares no install lifecycle hook. Its user-invoked setup writes the package's own Amp permission and plugin configuration; the inspected source does not establish an attack beyond that agent capability setup.

Static reason

No blocking static signals were detected.

Trigger

A user invokes the ory-amp-setup bin without --print or --uninstall.

Impact

Amp routes tool permission decisions through the Ory helper and loads the package's in-process plugin; this is an explicit setup capability.

Mechanism

The command writes a delegate entry to Amp settings and creates an Ory plugin loader in the project configuration.

AI rationale

Evidence

~/.config/amp/settings.json.amp/plugins/ory.ts

Decision evidence

public snapshot

AI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The setup CLI is an explicitly invoked package bin; the manifest has no install lifecycle hook.
Running setup without --print or --uninstall writes a global Amp permission delegate for every tool and creates a project plugin loader.
The setup behavior installs the package's own Amp permission and auditing integration, with no source evidence of an unconsented install-time mutation.

Evidence against

The delegate is global by default and applies to the wildcard tool scope.
The CLI also writes an Amp plugin loader into the project configuration.

Behavioral surface

Source

EnvironmentVarsFilesystem

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 7 file(s), 37.0 KB of source, external domains: agents.console.ory.com

Source & flagged code

6 flagged

dist/cli/setup.jsView file

Lines 75-133javascript

75/** Direct *.ts loader Amp's Bun runtime discovers under .amp/plugins/. */

76const PLUGIN_FILE = "ory.ts";

77/**

78 * Resolve this install's runtime and write its shims.

79 *

80 * Amp needs both halves: the permission delegate is a *program* Amp executes

81 * (so it gets the hook shim), while activity auditing is an in-process

82 * plugin Amp's Bun runtime imports (so the loader re-exports the runtime's main

83 * module by absolute path).

84 */

85function wireAmpRuntime(args) {

86 return (0, argus_1.wireRuntime)({

87 harness: "amp",

88 packageName: PACKAGE_NAME,

89 packageRoot: PACKAGE_ROOT,

90 installCommand: "npx -y -p @ory/amp ory-amp install",

91 args,

92 entryRelPath: path.join("dist", "permission.js"),

93 });

94}

95function getSettingsPath(_args) {

96 // Verified: Amp's default settings file is the user-global

97 // ~/.config/amp/settings.json (the `--settings-file` default). Amp's own

98 // permission entries are global by default; `-w/--workspace` would scope

99 // them to the project. We follow the verified default.

Medium

Ai Review Evidence

Running setup without --print or --uninstall writes a global Amp permission delegate for every tool and creates a project plugin loader.

dist/cli/setup.jsView on unpkg · L95

100 return path.join(os.homedir(), ".config", "amp", "settings.json");

101}

102/**

103 * The `amp.permissions` delegate entry that routes every tool ("*") through

104 * the Ory permission helper. Amp invokes the named program with the tool

105 * params on stdin and reads the decision from the exit code.

106 *

107 * Verified against the binary: a flat top-level `amp.permissions` array of

108 * `{ tool, action, to }` entries, and `to` accepts an **absolute path** — its

109 * help text says the helper "must be on $PATH", but a path works and is what

110 * we write. That matters beyond consistency: a bare bin name only resolves

111 * from a shell-initialized PATH, which a GUI-launched Amp does not have.

112 */

113function delegateEntry(to) {

114 return { tool: "*", action: "delegate", to };

115}

116function isOryDelegate(entry) {

117 if (typeof entry !== "object" || entry === null)

Medium

Ai Review Evidence

Running setup without --print or --uninstall writes a global Amp permission delegate for every tool and creates a project plugin loader.

dist/cli/setup.jsView on unpkg · L113

118 return false;

119 const rec = entry;

120 if (rec.action !== "delegate")

121 return false;

122 const to = typeof rec.to === "string" ? rec.to : "";

123 // Match the shim we write now and the bare bin name earlier releases wrote,

124 // so an install replaces a stale entry instead of leaving both in place.

125 return to === "ory-amp-permission" || /ory-hook-amp\.(js|cjs|mjs)$/.test(to);

126}

127function mergePermissions(existing, to) {

128 const merged = { ...existing };

129 const perms = (Array.isArray(merged["amp.permissions"])

130 ? merged["amp.permissions"]

131 : []).filter((e) => !isOryDelegate(e));

132 perms.push(delegateEntry(to));

133 merged["amp.permissions"] = perms;

Lines 145-228javascript

145 merged["amp.permissions"] = perms;

146 }

147 return merged;

148}

149/**

150 * The in-process plugin loader written at `.amp/plugins/ory.ts`. Amp's Bun

151 * TypeScript runtime discovers direct `*.ts` files under `.amp/plugins/`, so

152 * this re-exports the resolved runtime's default-exported plugin factory by

153 * absolute path — a bare module id would depend on `@ory/amp` being resolvable

154 * from wherever Amp runs.

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. nst to = typeof rec.to === "string" ? rec.to : ""; return to === "ory-amp-permission" || /ory-hook-amp\.(js|cjs|mjs)$/.test(to); } function mergepermissions(existing, to) { const merged = { ...existing }; const perms = (array.isarray(merged["amp.permissions"]) ? merged["amp.permissions"] : []).filter((e) => !isorydelegate(e)); perms.push(delegateentry(to)); merged["amp.permissions"] = perms; return merged; } function removepermissions(existing) { const merged = { ...existing };

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/cli/setup.jsView on unpkg

package.jsonView file

Lines 42-82json

42 "keto",

43 "hydra"

44 ],

45 "publishConfig": {

46 "access": "public",

47 "registry": "https://registry.npmjs.org/",

Source & flagged code

6 flagged · loading source

dist/cli/setup.jsView file

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/cli/setup.jsView on unpkg

165function main() { if (process.argv.includes("--help") || process.argv.includes("-h")) { (0, argus_1.printSetupHelp)("ory-amp-setup", "Amp"); process.exit(0); } const args = (0, argus_1.parseSetupArgs)(); if (args.print) { // Nothing is resolved or written on a --print run. console.log(JSON.stringify({ "amp.permissions": [delegateEntry("<res

Medium

Ai Review Evidence

Running setup without --print or --uninstall writes a global Amp permission delegate for every tool and creates a project plugin loader.

dist/cli/setup.js

Findings

1 High6 Medium4 Low

HighTrigger Reachable External Ai Agent Control Surface Mutationdist/cli/setup.js

MediumEnvironment Vars

MediumSuspicious Lifecycle Evidencepackage.json

MediumAi Review Evidencedist/cli/setup.js

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @ory/amp@1.2.4.

See all versions of @ory/amp for other recorded verdicts.

Review the evidence and your use of @ory/amp@1.2.4 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-11 04:27:17.517Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.