registry / @ory/amp / 1.3.0

@ory/amp@1.3.0

Ory plugin for Amp (Sourcegraph's coding agent): a permission delegate that authorizes every tool call plus an in-process plugin for session auth and activity auditing

AI Security Review

scanned 12d ago · by lpm-firewall-ai

The package provides a user-invoked setup command that installs its own Amp integration, a guarded agent extension lifecycle risk. No install lifecycle hook or concrete malicious behavior was identified in the inspected source.

Static reason

No blocking static signals were detected.

Trigger

A user runs the exposed ory-amp-setup CLI.

Impact

This registers package-owned authorization and activity-auditing integration with Amp; no concrete attack was established from the inspected source.

Mechanism

It updates Amp permissions and writes a plugin loader into the project’s .amp/plugins directory.

AI rationale

Evidence

package.jsondist/cli/setup.js

Decision evidence

public snapshot

AI called this Suspicious at 87.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The package exposes setup as a user-invoked CLI binary.
Running setup writes an Amp permission delegate and an in-process plugin loader, installing package-owned agent integration.

Evidence against

package.json has no preinstall, install, or postinstall hook, so the agent configuration changes do not run during package installation.
The setup code writes Ory integration entries and includes an uninstall path; no malicious behavior was identified in the inspected source.

Behavioral surface

Source

EnvironmentVarsFilesystem

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 7 file(s), 37.0 KB of source, external domains: agents.console.ory.com

Source & flagged code

4 flagged

dist/cli/setup.jsView file

Lines 145-228javascript

145 merged["amp.permissions"] = perms;

146 }

147 return merged;

148}

149/**

150 * The in-process plugin loader written at `.amp/plugins/ory.ts`. Amp's Bun

151 * TypeScript runtime discovers direct `*.ts` files under `.amp/plugins/`, so

152 * this re-exports the resolved runtime's default-exported plugin factory by

153 * absolute path — a bare module id would depend on `@ory/amp` being resolvable

154 * from wherever Amp runs.

155 */

156function pluginLoaderSource(runtime) {

157 const entry = path.join(runtime.target.packageDir, "dist", "index.js");

158 return (`// Generated by ${PACKAGE_NAME}@${runtime.target.version} — do not edit by hand.\n` +

159 `// Re-exports the Ory in-process plugin for Amp's .amp/plugins/ loader.\n` +

160 `export { default } from ${JSON.stringify(entry)};\n`);

161}

162function getPluginFile(args) {

163 return path.join(args.projectDir, ".amp", "plugins", PLUGIN_FILE);

164}

165function main() {

166 if (process.argv.includes("--help") || process.argv.includes("-h")) {

167 (0, argus_1.printSetupHelp)("ory-amp-setup", "Amp");

168 process.exit(0);

169 }

170 const args = (0, argus_1.parseSetupArgs)();

Medium

Ai Review Evidence

Running setup writes an Amp permission delegate and an in-process plugin loader, installing package-owned agent integration.

dist/cli/setup.jsView on unpkg · L165

171 if (args.print) {

172 // Nothing is resolved or written on a --print run.

173 console.log(JSON.stringify({ "amp.permissions": [delegateEntry("<resolved runtime shim>")] }, null, 2));

174 return;

175 }

176 const settingsPath = getSettingsPath(args);

177 const pluginFile = getPluginFile(args);

178 const skillsDir = path.join(args.projectDir, ".agents", "skills");

179 const existing = (0, argus_1.readJsonFile)(settingsPath);

180 if (args.uninstall) {

181 if (fs.existsSync(settingsPath)) {

182 const updated = removePermissions(existing);

183 (0, argus_1.writeJsonFile)(settingsPath, updated);

184 console.log(`Removed Ory permission delegate from ${settingsPath}`);

185 }

188 }

189 if (fs.existsSync(pluginFile)) {

190 fs.rmSync(pluginFile, { force: true });

191 console.log(`Removed Ory in-process plugin from ${pluginFile}`);

192 }

193 (0, assets_js_1.uninstallAmpOryAssets)(args.projectDir);

194 console.log(`Removed Ory skills from ${skillsDir}`);

195 (0, argus_1.removeRuntimeWiring)("amp");

196 for (const pruned of (0, argus_1.pruneRuntimeStores)()) {

197 console.log(` Removed runtime: ${pruned}`);

198 }

199 return;

200 }

201 const runtime = wireAmpRuntime(process.argv.slice(2));

202 console.log(runtime.target.kind === "linked"

203 ? `Runtime: linked to ${runtime.target.packageDir} (dev)`

204 : `Runtime: ${runtime.target.packageName}@${runtime.target.version} in ${runtime.target.storeDir}`);

205 for (const pruned of runtime.prunedStores) {

206 console.log(` Removed stale runtime: ${pruned}`);

207 }

208 // (a) Register the permission delegate (blocking gate).

209 const merged = mergePermissions(existing, runtime.hookShim);

210 (0, argus_1.writeJsonFile)(settingsPath, merged);

211 // (b) Write the in-process plugin loader (auth + activity auditing).

212 fs.mkdirSync(path.dirname(pluginFile), { recursive: true });

213 fs.writeFileSync(pluginFile, pluginLoaderSource(runtime));

Medium

Ai Review Evidence

Running setup writes an Amp permission delegate and an in-process plugin loader, installing package-owned agent integration.

dist/cli/setup.jsView on unpkg · L208

214 // (c) Materialize the Ory skill catalog.

215 (0, assets_js_1.installAmpOryAssets)(args.projectDir);

216 console.log(`Ory permission delegate registered in ${settingsPath}`);

217 console.log(` Delegate: ${runtime.hookShim} (tool: "*", action: delegate)`);

218 console.log(`Ory in-process plugin written to ${pluginFile}`);

219 console.log(`Ory skills installed under ${skillsDir}`);

220 (0, argus_1.printNextSteps)("Amp", "npx -y -p @ory/amp ory-amp-setup --uninstall", {

221 binName: "ory-amp",

222 harness: "amp",

223 });

224}

225main();

226// When invoked directly as the `-setup` bin with `--uninstall`, also clear

227// stored Ory credentials. When required by the plugin's main CLI, that

228// command owns the purge, so the `require.main` guard prevents a double run.

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. nst to = typeof rec.to === "string" ? rec.to : ""; return to === "ory-amp-permission" || /ory-hook-amp\.(js|cjs|mjs)$/.test(to); } function mergepermissions(existing, to) { const merged = { ...existing }; const perms = (array.isarray(merged["amp.permissions"]) ? merged["amp.permissions"] : []).filter((e) => !isorydelegate(e)); perms.push(delegateentry(to)); merged["amp.permissions"] = perms; return merged; } function removepermissions(existing) { const merged = { ...existing };

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/cli/setup.jsView on unpkg

package.jsonView file

Lines 42-82json

42 "keto",

43 "hydra"

44 ],

45 "publishConfig": {

46 "access": "public",

47 "registry": "https://registry.npmjs.org/",

Source & flagged code

4 flagged · loading source

dist/cli/setup.jsView file

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/cli/setup.jsView on unpkg

208// (a) Register the permission delegate (blocking gate). const merged = mergePermissions(existing, runtime.hookShim); (0, argus_1.writeJsonFile)(settingsPath, merged); // (b) Write the in-process plugin loader (auth + activity auditing). fs.mkdirSync(path.dirname(pluginFile), { recursive: true }); fs.writeFileSync(pluginFile, pluginLo

Medium

Ai Review Evidence

Running setup writes an Amp permission delegate and an in-process plugin loader, installing package-owned agent integration.

dist/cli/setup.jsView on unpkg · L208

Findings

1 High4 Medium3 Low

HighTrigger Reachable External Ai Agent Control Surface Mutationdist/cli/setup.js

MediumEnvironment Vars

MediumAi Review Evidencepackage.json

MediumAi Review Evidencedist/cli/setup.js

LowScripts Present

LowFilesystem

LowUrl Strings

Affected versions and remediation

This report applies to @ory/amp@1.3.0.

See all versions of @ory/amp for other recorded verdicts.

Review the evidence and your use of @ory/amp@1.3.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-11 04:27:37.072Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.