@ory/amp@1.4.0: AI-agent capability abuse – npm package flagged

AI Security Review

scanned 12d ago · by lpm-firewall-ai

The package changes Amp's control surface through a user-invoked setup or install command, a first-party agent extension setup that warrants a warning. The inspected manifest declares no install lifecycle hook, and the reviewed plugin entrypoint shows no concrete attack behavior.

Static reason

No blocking static signals were detected.

Trigger

A user runs the exposed setup command or invokes the main CLI install flow.

Impact

Amp tool calls and the plugin's session behavior are routed through package-owned code; no malicious action was confirmed in inspected entrypoint source.

Mechanism

Setup updates Amp settings with a wildcard tool delegate and writes a project plugin loader that re-exports this package's runtime.

AI rationale

The package changes Amp's control surface through a user-invoked setup or install command, a first-party agent extension setup that warrants a warning. The inspected manifest declares no install lifecycle hook, and the reviewed plugin entrypoint shows no concrete attack behavior.

Evidence

package.jsondist/cli/setup.jsdist/index.js~/.config/amp/settings.json<projectDir>/.amp/plugins/ory.ts

Decision evidence

public snapshot

AI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The manifest exposes setup and main CLI commands, with no install lifecycle script.
The setup command writes a global Amp permission delegate for all tools and a project plugin loader.
The plugin loader imports this package's own runtime entrypoint.

Evidence against

The configuration changes occur through an explicit setup command; no install lifecycle hook is declared.
The plugin points to this package's own runtime, and inspected entrypoint code shows no network or environment-variable access.

Behavioral surface

Source

EnvironmentVarsFilesystem

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 7 file(s), 37.0 KB of source, external domains: agents.console.ory.com

Source & flagged code

5 flagged

dist/cli/setup.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. nst to = typeof rec.to === "string" ? rec.to : ""; return to === "ory-amp-permission" || /ory-hook-amp\.(js|cjs|mjs)$/.test(to); } function mergepermissions(existing, to) { const merged = { ...existing }; const perms = (array.isarray(merged["amp.permissions"]) ? merged["amp.permissions"] : []).filter((e) => !isorydelegate(e)); perms.push(delegateentry(to)); merged["amp.permissions"] = perms; return merged; } function removepermissions(existing) { const merged = { ...existing };

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/cli/setup.jsView on unpkg

208// (a) Register the permission delegate (blocking gate). const merged = mergePermissions(existing, runtime.hookShim); (0, argus_1.writeJsonFile)(settingsPath, merged); // (b) Write the in-process plugin loader (auth + activity auditing). fs.mkdirSync(path.dirname(plugin

Medium

Ai Review Evidence

The setup command writes a global Amp permission delegate for all tools and a project plugin loader.

dist/cli/setup.jsView on unpkg · L208

156function pluginLoaderSource(runtime) { const entry = path.join(runtime.target.packageDir, "dist", "index.js"); return (`// Generated by ${PACKAGE_NAME}@${runtime.target.version} — do not edit by

Medium

Ai Review Evidence

The plugin loader imports this package's own runtime entrypoint.

dist/cli/setup.jsView on unpkg · L156

package.jsonView file

62"bin": { "ory-amp": "dist/cli/main.js", "ory-amp-permission": "dist/permission.js", "ory-amp-setup": "dist/cli/setup.js" }, "files": [ "dist", "!dist/**/*.tsbuildinfo" ], "dependencies": {

Medium

Suspicious Lifecycle Evidence

The manifest exposes setup and main CLI commands, with no install lifecycle script.

package.jsonView on unpkg · L62

dist/index.jsView file

10// Amp loads in-process plugins via import() and expects a default-exported // plugin function `(api) => void`. CJS output (module: nodenext → CJS) // surfaces `module.exports` as the ESM `defa

Medium

Ai Review Evidence

The plugin loader imports this package's own runtime entrypoint.

dist/index.jsView on unpkg · L10

Source & flagged code

5 flagged · loading source

dist/cli/setup.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. nst to = typeof rec.to === "string" ? rec.to : ""; return to === "ory-amp-permission" || /ory-hook-amp\.(js|cjs|mjs)$/.test(to); } function mergepermissions(existing, to) { const merged = { ...existing }; const perms = (array.isarray(merged["amp.permissions"]) ? merged["amp.permissions"] : []).filter((e) => !isorydelegate(e)); perms.push(delegateentry(to)); merged["amp.permissions"] = perms; return merged; } function removepermissions(existing) { const merged = { ...existing };

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/cli/setup.jsView on unpkg

208// (a) Register the permission delegate (blocking gate). const merged = mergePermissions(existing, runtime.hookShim); (0, argus_1.writeJsonFile)(settingsPath, merged); // (b) Write the in-process plugin loader (auth + activity auditing). fs.mkdirSync(path.dirname(plugin

Medium

Ai Review Evidence

The setup command writes a global Amp permission delegate for all tools and a project plugin loader.

dist/cli/setup.jsView on unpkg · L208

Findings

1 High5 Medium3 Low

HighTrigger Reachable External Ai Agent Control Surface Mutationdist/cli/setup.js

MediumEnvironment Vars

MediumSuspicious Lifecycle Evidencepackage.json

MediumAi Review Evidencedist/cli/setup.js

MediumAi Review Evidencedist/index.js

LowScripts Present

LowFilesystem

LowUrl Strings

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Behavioral surface

Source & flagged code