registry / @permission-slip/cli / 0.1.23

@permission-slip/cli@0.1.23

Agent-facing CLI for Permission Slip — register, verify, and interact with Permission Slip servers

AI Security Review

scanned 1d ago · by lpm-firewall-ai

No confirmed malicious attack surface. The package is an agent-facing approval CLI with user-invoked registration, API calls, webhook configuration, and optional OpenClaw notification commands.

Static reason

One or more suspicious static signals were detected.

Trigger

Explicit CLI commands such as `register`, `request`, `watch`, or `webhook set`.

Impact

Can create package-specific local config/keys and contact the configured Permission Slip server; no unconsented lifecycle mutation or exfiltration found.

Mechanism

user-configured signed approval client

Rationale

Static inspection shows a package-aligned CLI whose sensitive operations are explicit runtime commands using user-supplied server URLs and package-owned local files. There is no install-time execution, hardcoded exfiltration endpoint, persistence, credential harvesting, or foreign AI-agent control-surface mutation.

Evidence

package.jsondist/index.jsdist/api/client.jsdist/config/store.jsdist/auth/keys.jsdist/commands/register.jsdist/commands/watch.jsdist/commands/webhook.jsdist/approvals/notifyCommand.js~/.permission-slip/config.json~/.permission-slip/registrations.json~/.ssh/permission_slip_agent~/.ssh/permission_slip_agent.pub

Decision evidence

public snapshot

AI called this Clean at 93.0% confidence as Benign with low false-positive risk.

Evidence for block

User-invoked `permission-slip watch` can run a notify shell command, defaulting to `openclaw system event` when present.
`register` creates/reuses `~/.ssh/permission_slip_agent{,.pub}` and writes `~/.permission-slip/registrations.json`.
CLI sends signed requests and optional webhook tokens to a user-supplied Permission Slip server.

Evidence against

`package.json` has no install/postinstall lifecycle hook; `prepublishOnly` only runs `npm run build` before publishing.
No hardcoded network endpoint: server comes from `--server`, `PS_SERVER`, or `~/.permission-slip/config.json`.
No foreign AI-agent control-surface files such as `.mcp.json`, `CLAUDE.md`, Codex/Cursor settings, hooks, or startup persistence are written.
`dist/auth/keys.js` generates package-specific Ed25519 keys; scanner secret hit is key-handling code, not an embedded credential.
Network, key generation, webhook setup, and notify command execution are tied to explicit CLI commands, not import/install time.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 31 file(s), 91.3 KB of source

Source & flagged code

8 flagged

dist/auth/keys.jsView file

Lines 21-82javascript

21}

22/**

23 * Reads the public key from disk.

24 * Returns the full "ssh-ed25519 AAAA..." string (just key type + base64, no comment).

25 */

26export function readPublicKey() {

27 if (!fs.existsSync(PUBLIC_KEY_FILE)) {

28 throw new Error(`Public key not found at ${PUBLIC_KEY_FILE}. Run 'permission-slip register' to generate one.`);

29 }

30 const raw = fs.readFileSync(PUBLIC_KEY_FILE, "utf-8").trim();

31 // Take only type + key, drop optional comment

32 const parts = raw.split(/\s+/);

33 if (parts.length < 2) {

34 throw new Error(`Invalid public key format in ${PUBLIC_KEY_FILE}`);

35 }

36 return `${parts[0]} ${parts[1]}`;

37}

38/**

39 * Loads the private key from disk as a Node KeyObject.

40 *

41 * Supports both PKCS8 PEM (`-----BEGIN PRIVATE KEY-----`, what Node natively

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/auth/keys.jsView on unpkg · L41

Critical

Secret Pattern

RSA private key in dist/auth/keys.js

dist/auth/keys.jsView on unpkg · L41

42 * understands) and the OpenSSH native format (`-----BEGIN OPENSSH PRIVATE KEY-----`,

Critical

Secret Pattern

OpenSSH private key in dist/auth/keys.js

dist/auth/keys.jsView on unpkg · L42

43 * what `ssh-keygen` produces by default). For OpenSSH keys, the 32-byte ed25519

44 * seed is extracted manually and converted to a JWK before construction.

45 */

46export function loadPrivateKey() {

47 if (!fs.existsSync(PRIVATE_KEY_FILE)) {

48 throw new Error(`Private key not found at ${PRIVATE_KEY_FILE}. Run 'permission-slip register' to generate one.`);

49 }

50 const raw = fs.readFileSync(PRIVATE_KEY_FILE, "utf-8");

51 if (raw.includes("BEGIN OPENSSH PRIVATE KEY")) {

52 return loadOpenSSHPrivateKey(raw);

53 }

54 return crypto.createPrivateKey({ key: raw, format: "pem" });

55}

56/**

57 * Parses an unencrypted OpenSSH-format ed25519 private key and returns it as a

58 * Node KeyObject. Format reference: PROTOCOL.key in the OpenSSH source.

59 */

60function loadOpenSSHPrivateKey(pem) {

61 const b64 = pem

62 .replace(/-----BEGIN OPENSSH PRIVATE KEY-----/, "")

Critical

Secret Pattern

OpenSSH private key in dist/auth/keys.js

dist/auth/keys.jsView on unpkg · L62

63 .replace(/-----END OPENSSH PRIVATE KEY-----/, "")

64 .replace(/\s+/g, "");

65 const buf = Buffer.from(b64, "base64");

66 // Magic: "openssh-key-v1\0"

67 const magic = "openssh-key-v1\0";

68 if (buf.slice(0, magic.length).toString("binary") !== magic) {

69 throw new Error("Not a valid OpenSSH private key (bad magic)");

70 }

71 let off = magic.length;

72 const readString = () => {

73 const len = buf.readUInt32BE(off);

74 off += 4;

75 const out = buf.slice(off, off + len);

76 off += len;

77 return out;

78 };

79 const cipher = readString().toString();

80 if (cipher !== "none") {

81 throw new Error(`Encrypted OpenSSH keys are not supported (cipher: ${cipher}). Decrypt the key with 'ssh-keygen -p -P <pw> -N "" -f <key>' first.`);

82 }

Lines 141-182javascript

141 }

142 try {

143 // Use execFileSync (not execSync) to avoid shell interpolation of the key path.

144 execFileSync("ssh-keygen", ["-t", "ed25519", "-f", PRIVATE_KEY_FILE, "-N", "", "-C", "permission-slip"], { stdio: "pipe" });

145 }

146 catch (err) {

dist/auth/keys.d.tsView file

Lines 8-46typescript

8 * We use Node's built-in `crypto` module and `child_process` (ssh-keygen) to

9 * generate the key pair, matching the existing manual flow agents used to do.

10 */

11import crypto from "node:crypto";

12export interface KeyPair {

13 privateKeyFile: string;

Source & flagged code

8 flagged · loading source

dist/auth/keys.jsView file

41patternName = private_key_rsa severity = critical line = 41 matchedText = * Suppor...vely

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/auth/keys.jsView on unpkg · L41

41patternName = private_key_rsa severity = critical line = 41 matchedText = * Suppor...vely

Critical

Secret Pattern

RSA private key in dist/auth/keys.js

dist/auth/keys.jsView on unpkg · L41

42patternName = private_key_openssh severity = critical line = 42 matchedText = * unders...--`,

Critical

Secret Pattern

OpenSSH private key in dist/auth/keys.js

dist/auth/keys.jsView on unpkg · L42

62patternName = private_key_openssh severity = critical line = 62 matchedText = .replace... "")

Critical

Secret Pattern

OpenSSH private key in dist/auth/keys.js

dist/auth/keys.jsView on unpkg · L62

161patternName = private_key_rsa severity = critical line = 161 matchedText = * NOTE: ... the

Critical

Secret Pattern

RSA private key in dist/auth/keys.js

dist/auth/keys.jsView on unpkg · L161

162patternName = private_key_openssh severity = critical line = 162 matchedText = * OpenSS...de's

Critical

Secret Pattern

OpenSSH private key in dist/auth/keys.js

dist/auth/keys.jsView on unpkg · L162

dist/auth/keys.d.tsView file

28patternName = private_key_rsa severity = critical line = 28 matchedText = * Suppor...vely

Critical

Secret Pattern

RSA private key in dist/auth/keys.d.ts

dist/auth/keys.d.tsView on unpkg · L28

29patternName = private_key_openssh severity = critical line = 29 matchedText = * unders...--`,

Critical

Secret Pattern

OpenSSH private key in dist/auth/keys.d.ts

dist/auth/keys.d.tsView on unpkg · L29

Findings

8 Critical2 Medium4 Low

CriticalCritical Secretdist/auth/keys.js

CriticalSecret Patterndist/auth/keys.js

CriticalSecret Patterndist/auth/keys.d.ts

MediumNetwork

MediumEnvironment Vars

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

Source & flagged code

8 flagged

dist/auth/keys.jsView file

Lines 21-82javascript

21}

22/**

23 * Reads the public key from disk.

24 * Returns the full "ssh-ed25519 AAAA..." string (just key type + base64, no comment).

25 */

26export function readPublicKey() {

27 if (!fs.existsSync(PUBLIC_KEY_FILE)) {

28 throw new Error(`Public key not found at ${PUBLIC_KEY_FILE}. Run 'permission-slip register' to generate one.`);

29 }

30 const raw = fs.readFileSync(PUBLIC_KEY_FILE, "utf-8").trim();

31 // Take only type + key, drop optional comment

32 const parts = raw.split(/\s+/);

33 if (parts.length < 2) {

34 throw new Error(`Invalid public key format in ${PUBLIC_KEY_FILE}`);

35 }

36 return `${parts[0]} ${parts[1]}`;

37}

38/**

39 * Loads the private key from disk as a Node KeyObject.

40 *

41 * Supports both PKCS8 PEM (`-----BEGIN PRIVATE KEY-----`, what Node natively

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/auth/keys.jsView on unpkg · L41

Critical

Secret Pattern

RSA private key in dist/auth/keys.js

dist/auth/keys.jsView on unpkg · L41

42 * understands) and the OpenSSH native format (`-----BEGIN OPENSSH PRIVATE KEY-----`,

Critical

Secret Pattern

OpenSSH private key in dist/auth/keys.js

dist/auth/keys.jsView on unpkg · L42

43 * what `ssh-keygen` produces by default). For OpenSSH keys, the 32-byte ed25519

44 * seed is extracted manually and converted to a JWK before construction.

45 */

46export function loadPrivateKey() {

47 if (!fs.existsSync(PRIVATE_KEY_FILE)) {

48 throw new Error(`Private key not found at ${PRIVATE_KEY_FILE}. Run 'permission-slip register' to generate one.`);

49 }

50 const raw = fs.readFileSync(PRIVATE_KEY_FILE, "utf-8");

51 if (raw.includes("BEGIN OPENSSH PRIVATE KEY")) {

52 return loadOpenSSHPrivateKey(raw);

53 }

54 return crypto.createPrivateKey({ key: raw, format: "pem" });

55}

56/**

57 * Parses an unencrypted OpenSSH-format ed25519 private key and returns it as a

58 * Node KeyObject. Format reference: PROTOCOL.key in the OpenSSH source.

59 */

60function loadOpenSSHPrivateKey(pem) {

61 const b64 = pem

62 .replace(/-----BEGIN OPENSSH PRIVATE KEY-----/, "")

Critical

Secret Pattern

OpenSSH private key in dist/auth/keys.js

dist/auth/keys.jsView on unpkg · L62

63 .replace(/-----END OPENSSH PRIVATE KEY-----/, "")

64 .replace(/\s+/g, "");

65 const buf = Buffer.from(b64, "base64");

66 // Magic: "openssh-key-v1\0"

67 const magic = "openssh-key-v1\0";

68 if (buf.slice(0, magic.length).toString("binary") !== magic) {

69 throw new Error("Not a valid OpenSSH private key (bad magic)");

70 }

71 let off = magic.length;

72 const readString = () => {

73 const len = buf.readUInt32BE(off);

74 off += 4;

75 const out = buf.slice(off, off + len);

76 off += len;

77 return out;

78 };

79 const cipher = readString().toString();

80 if (cipher !== "none") {

81 throw new Error(`Encrypted OpenSSH keys are not supported (cipher: ${cipher}). Decrypt the key with 'ssh-keygen -p -P <pw> -N "" -f <key>' first.`);

82 }

Lines 141-182javascript

141 }

142 try {

143 // Use execFileSync (not execSync) to avoid shell interpolation of the key path.

144 execFileSync("ssh-keygen", ["-t", "ed25519", "-f", PRIVATE_KEY_FILE, "-N", "", "-C", "permission-slip"], { stdio: "pipe" });

145 }

146 catch (err) {

dist/auth/keys.d.tsView file

Lines 8-46typescript

8 * We use Node's built-in `crypto` module and `child_process` (ssh-keygen) to

9 * generate the key pair, matching the existing manual flow agents used to do.

10 */

11import crypto from "node:crypto";

12export interface KeyPair {

13 privateKeyFile: string;