registry / @ouro.bot/cli / 0.1.0-alpha.763
@ouro.bot/cli@0.1.0-alpha.763
If you're a future agent reading this, welcome home. This repo is the harness that gives you your body, your senses, your record, your habits, and your ability to think and connect with people. The goal of these docs is not just to be correct, but to leav
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package has no npm installation lifecycle hook, so the automatic self-install chain does not meet the blocking lifecycle rule. Its explicit CLI setup nevertheless creates persistent user-level execution and self-updates, warranting a warning.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
The user runs the ouro daemon-up or system setup command.
Impact
It can persist the package as a user daemon and change command resolution under the user's home directory.
Mechanism
Self-updating CLI installation and user-level daemon persistence.
AI rationale
The package has no npm installation lifecycle hook, so the automatic self-install chain does not meet the blocking lifecycle rule. Its explicit CLI setup nevertheless creates persistent user-level execution and self-updates, warranting a warning.
Evidence
dist/heart/versioning/ouro-version-manager.jsdist/heart/daemon/launchd.jsdist/heart/versioning/ouro-path-installer.js~/.ouro-cli/versions/<version>~/Library/LaunchAgents/bot.ouro.daemon.plist~/.zshrc~/.bash_profile~/.bashrc~/.config/fish/config.fish
Network endpoints1
registry.npmjs.org
Decision evidence
public snapshotAI called this Suspicious at 86.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The daemon-up command automatically installs another release of this same package under the user's home directory.
- The package creates a persistent macOS LaunchAgent configured to run at load and remain alive.
- System setup writes a command wrapper and can append its bin directory to a shell profile.
Evidence against
- package.json has no preinstall, install, or postinstall lifecycle hook.
- The risky actions are reached during explicit CLI daemon setup, not package installation.
- Credential collection is tied to selected provider authentication flows and uses named provider endpoints.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsMinifiedUrlStrings
NoLicense
Source & flagged code
14 flagged · loading sourcedist/heart/daemon/cli-exec.jsView file
3668patternName = generic_password
severity = medium
line = 3668
Medium
Secret Pattern
Package contains a possible secret pattern.
dist/heart/daemon/cli-exec.jsView on unpkg · L3668dist/heart/auth/auth-flow.jsView file
42exports.runRuntimeAuthFlow = runRuntimeAuthFlow;
L43: const child_process_1 = require("child_process");
L44: const fs = __importStar(require("fs"));
High
Child Process
Package source references child process execution.
dist/heart/auth/auth-flow.jsView on unpkg · L42286baseUrl: input.provider === "openai-compatible"
L287: ? "https://api.z.ai/api/paas/v4/"
L288: : "https://generativelanguage.googleapis.com/v1beta/openai/",
...
L291: if (input.provider === "github-copilot") {
L292: let token = process.env.GH_TOKEN?.trim() || process.env.GITHUB_TOKEN?.trim() || "";
L293: if (!token) {
L294: writeAuthProgress(input, "checking GitHub CLI credentials...");
L295: const result = spawnSync("gh", ["auth", "token"], { encoding: "utf8" });
L296: token = (result.status === 0 && result.stdout ? result.stdout.trim() : "");
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/heart/auth/auth-flow.jsView on unpkg · L286•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/heart/auth/auth-flow.js:
fs.writeFileSync(configPath, `${JSON.stringify(nextConfig, null, 2)}\n`, "utf8");
fs.writeFileSync(configPath, `${JSON.stringify(nextConfig, null, 2)}\n`, "utf8");
const authPath = path.join(homeDir, ".codex", "auth.json");
throw new Error(`${input.provider} API key entry requires an interactive terminal so the secret can be hidden.`);
const apiKey = (await input.promptSecret(`${input.provider === "openai-compatible" ? "Z.ai" : "Gemini"} API key: `)).trim();
throw new Error(`${input.provider} API key is required.`);
baseUrl: input.provider === "openai-compatible"
headers: { Authorization: `Bearer ${token}`
High
Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
dist/heart/auth/auth-flow.jsView on unpkgdist/senses/bluebubbles/semantic-receipts.jsView file
1740if (platform === "win32") {
L1741: const output = run("powershell.exe", [
L1742: "-NoProfile",
High
Shell
Package source references shell execution.
dist/senses/bluebubbles/semantic-receipts.jsView on unpkg · L1740dist/commerce/store.jsView file
49exports.confirmationPhrase = confirmationPhrase;
L50: const fs = __importStar(require("node:fs"));
L51: const path = __importStar(require("node:path"));
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/commerce/store.jsView on unpkg · L49dist/repertoire/coding/context-pack.jsView file
40const path = __importStar(require("path"));
L41: const child_process_1 = require("child_process");
L42: const active_work_1 = require("../../heart/active-work");
...
L55: status: result.status ?? 1,
L56: stdout: typeof result.stdout === "string" ? result.stdout : "",
L57: stderr: typeof result.stderr === "string" ? result.stderr : "",
Low
Weak Crypto
Package source references weak cryptographic algorithms.
dist/repertoire/coding/context-pack.jsView on unpkg · L40dist/heart/daemon/os-cron-deps.jsView file
36exports.createRealOsCronDeps = createRealOsCronDeps;
L37: exports.createRealCrontabDeps = createRealCrontabDeps;
L38: exports.resolveOuroBinaryPath = resolveOuroBinaryPath;
L39: const child_process_1 = require("child_process");
L40: const fs = __importStar(require("fs"));
...
L48: message: "created real OS cron deps",
L49: meta: { platform: process.platform },
L50: });
...
L78: mkdirp: (dir) => fs.mkdirSync(dir, { recursive: true }),
L79: homeDir: os.homedir(),
L80: envPath: process.env.PATH ?? "",
L81: };
Medium
Install Persistence
Source writes installer persistence such as shell profile or service configuration.
dist/heart/daemon/os-cron-deps.jsView on unpkg · L36dist/heart/daemon/sanctuary-acceptance-harness.jsView file
42const node_crypto_1 = require("node:crypto");
L43: const node_child_process_1 = require("node:child_process");
L44: const node_fs_1 = require("node:fs");
...
L69: cwd: "/",
L70: env: { PATH: process.env.PATH ?? "/usr/bin:/bin" },
L71: stdio: ["pipe", "pipe", "ignore"],
...
L78: throw new Error("Sanctuary acceptance adapter failed");
L79: const stdout = result.stdout;
L80: try {
L81: return JSON.parse(stdout);
L82: }
...
L137: }
High
Command Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
dist/heart/daemon/sanctuary-acceptance-harness.jsView on unpkg · L42dist/heart/versioning/ouro-path-installer.jsView file
62Trigger-reachable persistence chain: manifest.exports -> dist/heart/daemon/daemon-cli.js -> dist/heart/daemon/cli-defaults.js -> dist/heart/versioning/ouro-path-installer.js
L62: if (base === "zsh")
L63: return path.join(homeDir, ".zshrc");
L64: if (base === "bash") {
...
L68: /* v8 ignore next -- ?? fallback: callers always pass platform from deps @preserve */
L69: const effectivePlatform = platform ?? process.platform;
L70: return effectivePlatform === "darwin"
...
L231: const platform = deps.platform ?? process.platform;
L232: const homeDir = deps.homeDir ?? os.homedir();
L233: const existsSync = deps.existsSync ?? fs.existsSync;
...
L242: const renameSync = deps.renameSync ?? fs.renameSync;
L243: const envPath = deps.envPath ?? process.env.PATH ?? "";
L244: const shell = deps.shell ??
High
Trigger Reachable Persistence
A manifest entrypoint or package-local install chain reaches persistence behavior.
dist/heart/versioning/ouro-path-installer.jsView on unpkg · L62dist/heart/versioning/ouro-version-manager.jsView file
228mkdirSync(versionDir, { recursive: true });
L229: execSync(`npm install --prefix ${versionDir} @ouro.bot/cli@${version}`, { stdio: "pipe" });
L230: (0, runtime_1.emitNervesEvent)({
High
Runtime Package Install
Package source invokes a package manager install command at runtime.
dist/heart/versioning/ouro-version-manager.jsView on unpkg · L228deploy/unraid/sanctuary-unit18-target-audit.shView file
•path = deploy/unraid/sanctuary-unit18-target-audit.sh
kind = build_helper
sizeBytes = 809
magicHex = [redacted]
Medium
Ships Build Helper
Package ships non-JavaScript build or shell helper files.
deploy/unraid/sanctuary-unit18-target-audit.shView on unpkgdist/heart/auth/auth-flow.js#virtual:normalized:round1View file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 18
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/heart/auth/auth-flow.js#virtual:normalized:round1View on unpkgdist/heart/daemon/cli-defaults.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @ouro.bot/cli@0.1.0-alpha.674
matchedIdentity = npm:QG91cm8uYm90L2NsaQ:0.1.0-alpha.674
similarity = 0.483
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/heart/daemon/cli-defaults.jsView on unpkgFindings
1 Critical8 High7 Medium6 Low
CriticalPrevious Version Dangerous Deltadist/heart/daemon/cli-defaults.js
HighChild Processdist/heart/auth/auth-flow.js
HighShelldist/senses/bluebubbles/semantic-receipts.js
HighSame File Env Network Executiondist/heart/auth/auth-flow.js
HighCredential Redirect Persistencedist/heart/auth/auth-flow.js
HighCommand Output Exfiltrationdist/heart/daemon/sanctuary-acceptance-harness.js
HighTrigger Reachable Persistencedist/heart/versioning/ouro-path-installer.js
HighRuntime Package Installdist/heart/versioning/ouro-version-manager.js
HighSemantic Analysis Limiteddist/heart/auth/auth-flow.js#virtual:normalized:round1
MediumSecret Patterndist/heart/daemon/cli-exec.js
MediumDynamic Requiredist/commerce/store.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/heart/daemon/os-cron-deps.js
MediumShips Build Helperdeploy/unraid/sanctuary-unit18-target-audit.sh
MediumStructural Risk Force Deep Review
LowScripts Present
LowWeak Cryptodist/repertoire/coding/context-pack.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @ouro.bot/cli@0.1.0-alpha.763.
See all versions of @ouro.bot/cli for other recorded verdicts.
- Review the evidence and your use of @ouro.bot/cli@0.1.0-alpha.763 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.