@ory/amp@1.3.1
Ory plugin for Amp (Sourcegraph's coding agent): a permission delegate that authorizes every tool call plus an in-process plugin for session auth and activity auditing
AI Security Review
scanned 12d ago · by lpm-firewall-aiThis is user-invoked first-party agent setup that changes Amp control configuration, warranting a warning under the package review policy. No concrete attack or install-time mutation was established.
Static reason
No blocking static signals were detected.
Trigger
A user invokes the package's setup CLI without --print or --uninstall.
Impact
This configures a first-party agent integration that participates in tool authorization and session auditing; source inspection did not establish an attack.
Mechanism
It registers the Ory delegate for all tools in Amp settings and writes a loader under the project plugin directory.
AI rationale
This is user-invoked first-party agent setup that changes Amp control configuration, warranting a warning under the package review policy. No concrete attack or install-time mutation was established.
Evidence
dist/cli/setup.js~/.config/amp/settings.json.amp/plugins/ory.ts
Decision evidence
public snapshotAI called this Suspicious at 94.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- package.json exposes setup as a CLI binary and has no install lifecycle hook.
- The setup command adds a delegate for every Amp tool and writes an in-process plugin loader.
- The configuration change runs from the setup CLI after argument parsing; it is not triggered by package installation.
Evidence against
- The package manifest contains no preinstall, install, or postinstall script.
- Setup supports an uninstall path that removes the Ory entries and plugin.
Behavioral surface
EnvironmentVarsFilesystem
UrlStrings
Source & flagged code
6 flagged · loading sourcedist/cli/setup.jsView file
•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation.
nst to = typeof rec.to === "string" ? rec.to : "";
return to === "ory-amp-permission" || /ory-hook-amp\.(js|cjs|mjs)$/.test(to);
}
function mergepermissions(existing, to) {
const merged = { ...existing };
const perms = (array.isarray(merged["amp.permissions"])
? merged["amp.permissions"]
: []).filter((e) => !isorydelegate(e));
perms.push(delegateentry(to));
merged["amp.permissions"] = perms;
return merged;
}
function removepermissions(existing) {
const merged = { ...existing };
High
Trigger Reachable External Ai Agent Control Surface Mutation
Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.
dist/cli/setup.jsView on unpkg103* The `amp.permissions` delegate entry that routes every tool ("*") through
* the Ory permission helper. Amp invokes the named program with the tool
* params on stdin and reads the decision from the exit code.
*
* Verified against the binary: a flat top-level
Medium
Ai Review Evidence
The setup command adds a delegate for every Amp tool and writes an in-process plugin loader.
dist/cli/setup.jsView on unpkg · L103Findings
1 High6 Medium3 Low
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/cli/setup.js
MediumEnvironment Vars
MediumSuspicious Lifecycle Evidencepackage.json
MediumSuspicious Lifecycle Evidencepackage.json
MediumAi Review Evidencedist/cli/setup.js
MediumAi Review Evidencedist/cli/setup.js
MediumAi Review Evidencedist/cli/setup.js
LowScripts Present
LowFilesystem
LowUrl Strings
Affected versions and remediation
This report applies to @ory/amp@1.3.1.
See all versions of @ory/amp for other recorded verdicts.
- Review the evidence and your use of @ory/amp@1.3.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.