registry / @permission-slip/cli / 0.1.21

@permission-slip/cli@0.1.21

Agent-facing CLI for Permission Slip — register, verify, and interact with Permission Slip servers

AI Security Review

scanned 2d ago · by lpm-firewall-ai

No confirmed malicious attack surface was found. Risky primitives are tied to explicit CLI actions for a Permission Slip approval workflow, not install-time execution or hidden persistence.

Static reason

One or more suspicious static signals were detected.

Trigger

User runs permission-slip commands such as register, config, request, or watch.

Impact

Can create package-owned local credentials/config, contact a user-configured server, and run a notification command when explicitly invoked.

Mechanism

user-invoked approval CLI with signed API calls, local key/config storage, and optional watcher notification command

Rationale

Source inspection shows an explicit agent-facing CLI whose network, key generation, config writes, and OpenClaw notification behavior are activated by user-run commands and are package-aligned. There is no install-time mutation of foreign AI-agent control surfaces, credential harvesting, hardcoded exfiltration endpoint, destructive behavior, or persistence outside the documented CLI workflow.

Evidence

package.jsondist/index.jsdist/api/client.jsdist/config/serverUrl.jsdist/config/store.jsdist/auth/keys.jsdist/approvals/notifyCommand.jsdist/approvals/watchLoop.jsdist/commands/register.jsdist/commands/watch.js~/.permission-slip/config.json~/.permission-slip/registrations.json~/.ssh/permission_slip_agent~/.ssh/permission_slip_agent.pub

Decision evidence

public snapshot

AI called this Clean at 91.0% confidence as Benign with low false-positive risk.

Evidence for block

dist/approvals/watchLoop.js executes a user/configured notify command via /bin/sh during the watch command.
dist/approvals/notifyCommand.js auto-detects openclaw and can wake an OpenClaw session when watch resolves.
dist/auth/keys.js invokes ssh-keygen and writes ~/.ssh/permission_slip_agent keys on register.

Evidence against

package.json has no install/postinstall/prepare lifecycle hook; prepublishOnly is publisher-side build only.
dist/index.js only registers Commander CLI subcommands; no import-time network or filesystem mutation beyond changelog notice logic.
dist/config/serverUrl.js requires user-supplied --server, PS_SERVER, or config default_server; no hardcoded exfiltration host.
dist/api/client.js sends signed Permission Slip API requests to the configured server for register/status/approval flows.
dist/config/store.js writes only package-owned ~/.permission-slip config/registration files.
No code writes foreign AI-agent control files such as .mcp.json, CLAUDE.md, Claude/Codex/Cursor settings, or shell startup persistence.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 29 file(s), 83.7 KB of source

Source & flagged code

8 flagged

dist/auth/keys.jsView file

Lines 21-82javascript

21}

22/**

23 * Reads the public key from disk.

24 * Returns the full "ssh-ed25519 AAAA..." string (just key type + base64, no comment).

25 */

26export function readPublicKey() {

27 if (!fs.existsSync(PUBLIC_KEY_FILE)) {

28 throw new Error(`Public key not found at ${PUBLIC_KEY_FILE}. Run 'permission-slip register' to generate one.`);

29 }

30 const raw = fs.readFileSync(PUBLIC_KEY_FILE, "utf-8").trim();

31 // Take only type + key, drop optional comment

32 const parts = raw.split(/\s+/);

33 if (parts.length < 2) {

34 throw new Error(`Invalid public key format in ${PUBLIC_KEY_FILE}`);

35 }

36 return `${parts[0]} ${parts[1]}`;

37}

38/**

39 * Loads the private key from disk as a Node KeyObject.

40 *

41 * Supports both PKCS8 PEM (`-----BEGIN PRIVATE KEY-----`, what Node natively

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/auth/keys.jsView on unpkg · L41

Critical

Secret Pattern

RSA private key in dist/auth/keys.js

dist/auth/keys.jsView on unpkg · L41

42 * understands) and the OpenSSH native format (`-----BEGIN OPENSSH PRIVATE KEY-----`,

Critical

Secret Pattern

OpenSSH private key in dist/auth/keys.js

dist/auth/keys.jsView on unpkg · L42

43 * what `ssh-keygen` produces by default). For OpenSSH keys, the 32-byte ed25519

44 * seed is extracted manually and converted to a JWK before construction.

45 */

46export function loadPrivateKey() {

47 if (!fs.existsSync(PRIVATE_KEY_FILE)) {

48 throw new Error(`Private key not found at ${PRIVATE_KEY_FILE}. Run 'permission-slip register' to generate one.`);

49 }

50 const raw = fs.readFileSync(PRIVATE_KEY_FILE, "utf-8");

51 if (raw.includes("BEGIN OPENSSH PRIVATE KEY")) {

52 return loadOpenSSHPrivateKey(raw);

53 }

54 return crypto.createPrivateKey({ key: raw, format: "pem" });

55}

56/**

57 * Parses an unencrypted OpenSSH-format ed25519 private key and returns it as a

58 * Node KeyObject. Format reference: PROTOCOL.key in the OpenSSH source.

59 */

60function loadOpenSSHPrivateKey(pem) {

61 const b64 = pem

62 .replace(/-----BEGIN OPENSSH PRIVATE KEY-----/, "")

Critical

Secret Pattern

OpenSSH private key in dist/auth/keys.js

dist/auth/keys.jsView on unpkg · L62

63 .replace(/-----END OPENSSH PRIVATE KEY-----/, "")

64 .replace(/\s+/g, "");

65 const buf = Buffer.from(b64, "base64");

66 // Magic: "openssh-key-v1\0"

67 const magic = "openssh-key-v1\0";

68 if (buf.slice(0, magic.length).toString("binary") !== magic) {

69 throw new Error("Not a valid OpenSSH private key (bad magic)");

70 }

71 let off = magic.length;

72 const readString = () => {

73 const len = buf.readUInt32BE(off);

74 off += 4;

75 const out = buf.slice(off, off + len);

76 off += len;

77 return out;

78 };

79 const cipher = readString().toString();

80 if (cipher !== "none") {

81 throw new Error(`Encrypted OpenSSH keys are not supported (cipher: ${cipher}). Decrypt the key with 'ssh-keygen -p -P <pw> -N "" -f <key>' first.`);

82 }

Lines 141-182javascript

141 }

142 try {

143 // Use execFileSync (not execSync) to avoid shell interpolation of the key path.

144 execFileSync("ssh-keygen", ["-t", "ed25519", "-f", PRIVATE_KEY_FILE, "-N", "", "-C", "permission-slip"], { stdio: "pipe" });

145 }

146 catch (err) {

dist/auth/keys.d.tsView file

Lines 8-46typescript

8 * We use Node's built-in `crypto` module and `child_process` (ssh-keygen) to

9 * generate the key pair, matching the existing manual flow agents used to do.

10 */

11import crypto from "node:crypto";

12export interface KeyPair {

13 privateKeyFile: string;

Source & flagged code

8 flagged · loading source

dist/auth/keys.jsView file

41patternName = private_key_rsa severity = critical line = 41 matchedText = * Suppor...vely

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/auth/keys.jsView on unpkg · L41

41patternName = private_key_rsa severity = critical line = 41 matchedText = * Suppor...vely

Critical

Secret Pattern

RSA private key in dist/auth/keys.js

dist/auth/keys.jsView on unpkg · L41

42patternName = private_key_openssh severity = critical line = 42 matchedText = * unders...--`,

Critical

Secret Pattern

OpenSSH private key in dist/auth/keys.js

dist/auth/keys.jsView on unpkg · L42

62patternName = private_key_openssh severity = critical line = 62 matchedText = .replace... "")

Critical

Secret Pattern

OpenSSH private key in dist/auth/keys.js

dist/auth/keys.jsView on unpkg · L62

161patternName = private_key_rsa severity = critical line = 161 matchedText = * NOTE: ... the

Critical

Secret Pattern

RSA private key in dist/auth/keys.js

dist/auth/keys.jsView on unpkg · L161

162patternName = private_key_openssh severity = critical line = 162 matchedText = * OpenSS...de's

Critical

Secret Pattern

OpenSSH private key in dist/auth/keys.js

dist/auth/keys.jsView on unpkg · L162

dist/auth/keys.d.tsView file

28patternName = private_key_rsa severity = critical line = 28 matchedText = * Suppor...vely

Critical

Secret Pattern

RSA private key in dist/auth/keys.d.ts

dist/auth/keys.d.tsView on unpkg · L28

29patternName = private_key_openssh severity = critical line = 29 matchedText = * unders...--`,

Critical

Secret Pattern

OpenSSH private key in dist/auth/keys.d.ts

dist/auth/keys.d.tsView on unpkg · L29

Findings

8 Critical2 Medium4 Low

CriticalCritical Secretdist/auth/keys.js

CriticalSecret Patterndist/auth/keys.js

CriticalSecret Patterndist/auth/keys.d.ts

MediumNetwork

MediumEnvironment Vars

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

Source & flagged code

8 flagged

dist/auth/keys.jsView file

Lines 21-82javascript

21}

22/**

23 * Reads the public key from disk.

24 * Returns the full "ssh-ed25519 AAAA..." string (just key type + base64, no comment).

25 */

26export function readPublicKey() {

27 if (!fs.existsSync(PUBLIC_KEY_FILE)) {

28 throw new Error(`Public key not found at ${PUBLIC_KEY_FILE}. Run 'permission-slip register' to generate one.`);

29 }

30 const raw = fs.readFileSync(PUBLIC_KEY_FILE, "utf-8").trim();

31 // Take only type + key, drop optional comment

32 const parts = raw.split(/\s+/);

33 if (parts.length < 2) {

34 throw new Error(`Invalid public key format in ${PUBLIC_KEY_FILE}`);

35 }

36 return `${parts[0]} ${parts[1]}`;

37}

38/**

39 * Loads the private key from disk as a Node KeyObject.

40 *

41 * Supports both PKCS8 PEM (`-----BEGIN PRIVATE KEY-----`, what Node natively

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/auth/keys.jsView on unpkg · L41

Critical

Secret Pattern

RSA private key in dist/auth/keys.js

dist/auth/keys.jsView on unpkg · L41

42 * understands) and the OpenSSH native format (`-----BEGIN OPENSSH PRIVATE KEY-----`,

Critical

Secret Pattern

OpenSSH private key in dist/auth/keys.js

dist/auth/keys.jsView on unpkg · L42

43 * what `ssh-keygen` produces by default). For OpenSSH keys, the 32-byte ed25519

44 * seed is extracted manually and converted to a JWK before construction.

45 */

46export function loadPrivateKey() {

47 if (!fs.existsSync(PRIVATE_KEY_FILE)) {

48 throw new Error(`Private key not found at ${PRIVATE_KEY_FILE}. Run 'permission-slip register' to generate one.`);

49 }

50 const raw = fs.readFileSync(PRIVATE_KEY_FILE, "utf-8");

51 if (raw.includes("BEGIN OPENSSH PRIVATE KEY")) {

52 return loadOpenSSHPrivateKey(raw);

53 }

54 return crypto.createPrivateKey({ key: raw, format: "pem" });

55}

56/**

57 * Parses an unencrypted OpenSSH-format ed25519 private key and returns it as a

58 * Node KeyObject. Format reference: PROTOCOL.key in the OpenSSH source.

59 */

60function loadOpenSSHPrivateKey(pem) {

61 const b64 = pem

62 .replace(/-----BEGIN OPENSSH PRIVATE KEY-----/, "")

Critical

Secret Pattern

OpenSSH private key in dist/auth/keys.js

dist/auth/keys.jsView on unpkg · L62

63 .replace(/-----END OPENSSH PRIVATE KEY-----/, "")

64 .replace(/\s+/g, "");

65 const buf = Buffer.from(b64, "base64");

66 // Magic: "openssh-key-v1\0"

67 const magic = "openssh-key-v1\0";

68 if (buf.slice(0, magic.length).toString("binary") !== magic) {

69 throw new Error("Not a valid OpenSSH private key (bad magic)");

70 }

71 let off = magic.length;

72 const readString = () => {

73 const len = buf.readUInt32BE(off);

74 off += 4;

75 const out = buf.slice(off, off + len);

76 off += len;

77 return out;

78 };

79 const cipher = readString().toString();

80 if (cipher !== "none") {

81 throw new Error(`Encrypted OpenSSH keys are not supported (cipher: ${cipher}). Decrypt the key with 'ssh-keygen -p -P <pw> -N "" -f <key>' first.`);

82 }

Lines 141-182javascript

141 }

142 try {

143 // Use execFileSync (not execSync) to avoid shell interpolation of the key path.

144 execFileSync("ssh-keygen", ["-t", "ed25519", "-f", PRIVATE_KEY_FILE, "-N", "", "-C", "permission-slip"], { stdio: "pipe" });

145 }

146 catch (err) {

dist/auth/keys.d.tsView file

Lines 8-46typescript

8 * We use Node's built-in `crypto` module and `child_process` (ssh-keygen) to

9 * generate the key pair, matching the existing manual flow agents used to do.

10 */

11import crypto from "node:crypto";

12export interface KeyPair {

13 privateKeyFile: string;