@ouro.bot/cli@0.1.0-alpha.765
If you're a future agent reading this, welcome home. This repo is the harness that gives you your body, your senses, your record, your habits, and your ability to think and connect with people. The goal of these docs is not just to be correct, but to leav
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is not a confirmed malicious install chain because the package has no install lifecycle hook and the observed mutations follow user-invoked CLI flows. Its persistence, self-installation, and root deployment broker are nevertheless dangerous capabilities that warrant a warning.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
The user selects hatch or runs the CLI; the broker requires an explicit root service launch.
Impact
It can alter user command resolution, fetch another package release, and perform destructive host operations in its Unraid deployment context.
Mechanism
Shell-profile persistence, self-update installation, and privileged host control.
AI rationale
This is not a confirmed malicious install chain because the package has no install lifecycle hook and the observed mutations follow user-invoked CLI flows. Its persistence, self-installation, and root deployment broker are nevertheless dangerous capabilities that warrant a warning.
Evidence
dist/heart/daemon/cli-exec.jsdist/heart/versioning/ouro-path-installer.jsdist/heart/daemon/cli-defaults.jsdist/heart/versioning/ouro-version-manager.jsdeploy/unraid/sanctuary-unit16-host-broker.mjs~/.ouro-cli/bin/ouro~/.local/bin/ouroshell profile selected from ~/.zshrc, ~/.bash_profile, ~/.bashrc, or ~/.config/fish/config.fish~/.ouro-cli/versions/<version>
Decision evidence
public snapshotAI called this Suspicious at 84.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- An interactive hatch choice runs system setup.
- Setup writes an Ouro launcher and appends its directory to a shell profile.
- The CLI can reinstall its own package version under the user profile at runtime.
- A shipped Unraid broker is root-only and can invoke a host reboot.
Evidence against
- The manifest has command entrypoints but no preinstall, install, or postinstall hook.
- The setup path is reached after the user chooses hatch, not during npm installation.
- Credential collection shown here uses an interactive prompt or existing local login and calls provider endpoints.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
14 flagged · loading sourcedist/heart/daemon/cli-exec.jsView file
3668patternName = generic_password
severity = medium
line = 3668
Medium
Secret Pattern
Package contains a possible secret pattern.
dist/heart/daemon/cli-exec.jsView on unpkg · L3668dist/heart/auth/auth-flow.jsView file
42exports.runRuntimeAuthFlow = runRuntimeAuthFlow;
L43: const child_process_1 = require("child_process");
L44: const fs = __importStar(require("fs"));
High
Child Process
Package source references child process execution.
dist/heart/auth/auth-flow.jsView on unpkg · L42286baseUrl: input.provider === "openai-compatible"
L287: ? "https://api.z.ai/api/paas/v4/"
L288: : "https://generativelanguage.googleapis.com/v1beta/openai/",
...
L291: if (input.provider === "github-copilot") {
L292: let token = process.env.GH_TOKEN?.trim() || process.env.GITHUB_TOKEN?.trim() || "";
L293: if (!token) {
L294: writeAuthProgress(input, "checking GitHub CLI credentials...");
L295: const result = spawnSync("gh", ["auth", "token"], { encoding: "utf8" });
L296: token = (result.status === 0 && result.stdout ? result.stdout.trim() : "");
Findings
1 Critical8 High7 Medium6 Low
CriticalPrevious Version Dangerous Deltadist/heart/daemon/cli-defaults.js
HighChild Processdist/heart/auth/auth-flow.js
HighShelldist/senses/bluebubbles/semantic-receipts.js
HighSame File Env Network Executiondist/heart/auth/auth-flow.js
HighCredential Redirect Persistencedist/heart/auth/auth-flow.js
HighCommand Output Exfiltrationdist/heart/daemon/sanctuary-acceptance-harness.js
HighTrigger Reachable Persistencedist/heart/versioning/ouro-path-installer.js
HighRuntime Package Installdist/heart/versioning/ouro-version-manager.js
HighSemantic Analysis Limiteddist/heart/auth/auth-flow.js#virtual:normalized:round1
MediumSecret Patterndist/heart/daemon/cli-exec.js
Affected versions and remediation
This report applies to @ouro.bot/cli@0.1.0-alpha.765.
See all versions of @ouro.bot/cli for other recorded verdicts.
- Review the evidence and your use of @ouro.bot/cli@0.1.0-alpha.765 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.