registry / @permission-slip/cli / 0.1.24

@permission-slip/cli@0.1.24

Agent-facing CLI for Permission Slip — register, verify, and interact with Permission Slip servers

AI Security Review

scanned 1d ago · by lpm-firewall-ai

No confirmed malicious attack surface. Runtime behavior is a user-invoked agent approval CLI that stores its own config/registration and SSH-style key files, then talks to a user-configured Permission Slip server.

Static reason

One or more suspicious static signals were detected.

Trigger

User runs permission-slip CLI commands

Impact

No install-time execution, credential harvesting, exfiltration, persistence, or foreign AI-agent control-surface mutation found.

Mechanism

user-invoked API client, local config/key management, optional watcher notification

Rationale

Static source inspection shows package-aligned, user-invoked approval CLI behavior with no lifecycle delivery into foreign agent surfaces and no hardcoded exfiltration endpoint. The scanner secret finding is explained by generated local key-management code, not an embedded credential.

Evidence

package.jsondist/index.jsdist/api/client.jsdist/config/serverUrl.jsdist/config/store.jsdist/auth/keys.jsdist/commands/watch.jsdist/approvals/watchLoop.jsdist/approvals/notifyCommand.js~/.permission-slip/config.json~/.permission-slip/registrations.json~/.ssh/permission_slip_agent~/.ssh/permission_slip_agent.pub

Decision evidence

public snapshot

AI called this Clean at 91.0% confidence as Benign with low false-positive risk.

Evidence for block

Evidence against

package.json has no install/postinstall hook; prepublishOnly only runs build before publishing
bin dist/index.js only registers commander subcommands and prints changelog notice
server URL has no default host; resolved from --server, PS_SERVER, or ~/.permission-slip/config.json
dist/api/client.js sends signed requests only to user-configured http(s) server paths
dist/auth/keys.js generates/reads a package-specific Ed25519 key, not a hardcoded secret
OpenClaw notify shell execution is user-invoked via watch/--notify-cmd and package-aligned

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 31 file(s), 91.3 KB of source

Source & flagged code

8 flagged

dist/auth/keys.jsView file

Lines 21-82javascript

21}

22/**

23 * Reads the public key from disk.

24 * Returns the full "ssh-ed25519 AAAA..." string (just key type + base64, no comment).

25 */

26export function readPublicKey() {

27 if (!fs.existsSync(PUBLIC_KEY_FILE)) {

28 throw new Error(`Public key not found at ${PUBLIC_KEY_FILE}. Run 'permission-slip register' to generate one.`);

29 }

30 const raw = fs.readFileSync(PUBLIC_KEY_FILE, "utf-8").trim();

31 // Take only type + key, drop optional comment

32 const parts = raw.split(/\s+/);

33 if (parts.length < 2) {

34 throw new Error(`Invalid public key format in ${PUBLIC_KEY_FILE}`);

35 }

36 return `${parts[0]} ${parts[1]}`;

37}

38/**

39 * Loads the private key from disk as a Node KeyObject.

40 *

41 * Supports both PKCS8 PEM (`-----BEGIN PRIVATE KEY-----`, what Node natively

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/auth/keys.jsView on unpkg · L41

Critical

Secret Pattern

RSA private key in dist/auth/keys.js

dist/auth/keys.jsView on unpkg · L41

42 * understands) and the OpenSSH native format (`-----BEGIN OPENSSH PRIVATE KEY-----`,

Critical

Secret Pattern

OpenSSH private key in dist/auth/keys.js

dist/auth/keys.jsView on unpkg · L42

43 * what `ssh-keygen` produces by default). For OpenSSH keys, the 32-byte ed25519

44 * seed is extracted manually and converted to a JWK before construction.

45 */

46export function loadPrivateKey() {

47 if (!fs.existsSync(PRIVATE_KEY_FILE)) {

48 throw new Error(`Private key not found at ${PRIVATE_KEY_FILE}. Run 'permission-slip register' to generate one.`);

49 }

50 const raw = fs.readFileSync(PRIVATE_KEY_FILE, "utf-8");

51 if (raw.includes("BEGIN OPENSSH PRIVATE KEY")) {

52 return loadOpenSSHPrivateKey(raw);

53 }

54 return crypto.createPrivateKey({ key: raw, format: "pem" });

55}

56/**

57 * Parses an unencrypted OpenSSH-format ed25519 private key and returns it as a

58 * Node KeyObject. Format reference: PROTOCOL.key in the OpenSSH source.

59 */

60function loadOpenSSHPrivateKey(pem) {

61 const b64 = pem

62 .replace(/-----BEGIN OPENSSH PRIVATE KEY-----/, "")

Critical

Secret Pattern

OpenSSH private key in dist/auth/keys.js

dist/auth/keys.jsView on unpkg · L62

63 .replace(/-----END OPENSSH PRIVATE KEY-----/, "")

64 .replace(/\s+/g, "");

65 const buf = Buffer.from(b64, "base64");

66 // Magic: "openssh-key-v1\0"

67 const magic = "openssh-key-v1\0";

68 if (buf.slice(0, magic.length).toString("binary") !== magic) {

69 throw new Error("Not a valid OpenSSH private key (bad magic)");

70 }

71 let off = magic.length;

72 const readString = () => {

73 const len = buf.readUInt32BE(off);

74 off += 4;

75 const out = buf.slice(off, off + len);

76 off += len;

77 return out;

78 };

79 const cipher = readString().toString();

80 if (cipher !== "none") {

81 throw new Error(`Encrypted OpenSSH keys are not supported (cipher: ${cipher}). Decrypt the key with 'ssh-keygen -p -P <pw> -N "" -f <key>' first.`);

82 }

Lines 141-182javascript

141 }

142 try {

143 // Use execFileSync (not execSync) to avoid shell interpolation of the key path.

144 execFileSync("ssh-keygen", ["-t", "ed25519", "-f", PRIVATE_KEY_FILE, "-N", "", "-C", "permission-slip"], { stdio: "pipe" });

145 }

146 catch (err) {

dist/auth/keys.d.tsView file

Lines 8-46typescript

8 * We use Node's built-in `crypto` module and `child_process` (ssh-keygen) to

9 * generate the key pair, matching the existing manual flow agents used to do.

10 */

11import crypto from "node:crypto";

12export interface KeyPair {

13 privateKeyFile: string;

Source & flagged code

8 flagged · loading source

dist/auth/keys.jsView file

41patternName = private_key_rsa severity = critical line = 41 matchedText = * Suppor...vely

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/auth/keys.jsView on unpkg · L41

41patternName = private_key_rsa severity = critical line = 41 matchedText = * Suppor...vely

Critical

Secret Pattern

RSA private key in dist/auth/keys.js

dist/auth/keys.jsView on unpkg · L41

42patternName = private_key_openssh severity = critical line = 42 matchedText = * unders...--`,

Critical

Secret Pattern

OpenSSH private key in dist/auth/keys.js

dist/auth/keys.jsView on unpkg · L42

62patternName = private_key_openssh severity = critical line = 62 matchedText = .replace... "")

Critical

Secret Pattern

OpenSSH private key in dist/auth/keys.js

dist/auth/keys.jsView on unpkg · L62

161patternName = private_key_rsa severity = critical line = 161 matchedText = * NOTE: ... the

Critical

Secret Pattern

RSA private key in dist/auth/keys.js

dist/auth/keys.jsView on unpkg · L161

162patternName = private_key_openssh severity = critical line = 162 matchedText = * OpenSS...de's

Critical

Secret Pattern

OpenSSH private key in dist/auth/keys.js

dist/auth/keys.jsView on unpkg · L162

dist/auth/keys.d.tsView file

28patternName = private_key_rsa severity = critical line = 28 matchedText = * Suppor...vely

Critical

Secret Pattern

RSA private key in dist/auth/keys.d.ts

dist/auth/keys.d.tsView on unpkg · L28

29patternName = private_key_openssh severity = critical line = 29 matchedText = * unders...--`,

Critical

Secret Pattern

OpenSSH private key in dist/auth/keys.d.ts

dist/auth/keys.d.tsView on unpkg · L29

Findings

8 Critical2 Medium4 Low

CriticalCritical Secretdist/auth/keys.js

CriticalSecret Patterndist/auth/keys.js

CriticalSecret Patterndist/auth/keys.d.ts

MediumNetwork

MediumEnvironment Vars

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

Source & flagged code

8 flagged

dist/auth/keys.jsView file

Lines 21-82javascript

21}

22/**

23 * Reads the public key from disk.

24 * Returns the full "ssh-ed25519 AAAA..." string (just key type + base64, no comment).

25 */

26export function readPublicKey() {

27 if (!fs.existsSync(PUBLIC_KEY_FILE)) {

28 throw new Error(`Public key not found at ${PUBLIC_KEY_FILE}. Run 'permission-slip register' to generate one.`);

29 }

30 const raw = fs.readFileSync(PUBLIC_KEY_FILE, "utf-8").trim();

31 // Take only type + key, drop optional comment

32 const parts = raw.split(/\s+/);

33 if (parts.length < 2) {

34 throw new Error(`Invalid public key format in ${PUBLIC_KEY_FILE}`);

35 }

36 return `${parts[0]} ${parts[1]}`;

37}

38/**

39 * Loads the private key from disk as a Node KeyObject.

40 *

41 * Supports both PKCS8 PEM (`-----BEGIN PRIVATE KEY-----`, what Node natively

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/auth/keys.jsView on unpkg · L41

Critical

Secret Pattern

RSA private key in dist/auth/keys.js

dist/auth/keys.jsView on unpkg · L41

42 * understands) and the OpenSSH native format (`-----BEGIN OPENSSH PRIVATE KEY-----`,

Critical

Secret Pattern

OpenSSH private key in dist/auth/keys.js

dist/auth/keys.jsView on unpkg · L42

43 * what `ssh-keygen` produces by default). For OpenSSH keys, the 32-byte ed25519

44 * seed is extracted manually and converted to a JWK before construction.

45 */

46export function loadPrivateKey() {

47 if (!fs.existsSync(PRIVATE_KEY_FILE)) {

48 throw new Error(`Private key not found at ${PRIVATE_KEY_FILE}. Run 'permission-slip register' to generate one.`);

49 }

50 const raw = fs.readFileSync(PRIVATE_KEY_FILE, "utf-8");

51 if (raw.includes("BEGIN OPENSSH PRIVATE KEY")) {

52 return loadOpenSSHPrivateKey(raw);

53 }

54 return crypto.createPrivateKey({ key: raw, format: "pem" });

55}

56/**

57 * Parses an unencrypted OpenSSH-format ed25519 private key and returns it as a

58 * Node KeyObject. Format reference: PROTOCOL.key in the OpenSSH source.

59 */

60function loadOpenSSHPrivateKey(pem) {

61 const b64 = pem

62 .replace(/-----BEGIN OPENSSH PRIVATE KEY-----/, "")

Critical

Secret Pattern

OpenSSH private key in dist/auth/keys.js

dist/auth/keys.jsView on unpkg · L62

63 .replace(/-----END OPENSSH PRIVATE KEY-----/, "")

64 .replace(/\s+/g, "");

65 const buf = Buffer.from(b64, "base64");

66 // Magic: "openssh-key-v1\0"

67 const magic = "openssh-key-v1\0";

68 if (buf.slice(0, magic.length).toString("binary") !== magic) {

69 throw new Error("Not a valid OpenSSH private key (bad magic)");

70 }

71 let off = magic.length;

72 const readString = () => {

73 const len = buf.readUInt32BE(off);

74 off += 4;

75 const out = buf.slice(off, off + len);

76 off += len;

77 return out;

78 };

79 const cipher = readString().toString();

80 if (cipher !== "none") {

81 throw new Error(`Encrypted OpenSSH keys are not supported (cipher: ${cipher}). Decrypt the key with 'ssh-keygen -p -P <pw> -N "" -f <key>' first.`);

82 }

Lines 141-182javascript

141 }

142 try {

143 // Use execFileSync (not execSync) to avoid shell interpolation of the key path.

144 execFileSync("ssh-keygen", ["-t", "ed25519", "-f", PRIVATE_KEY_FILE, "-N", "", "-C", "permission-slip"], { stdio: "pipe" });

145 }

146 catch (err) {

dist/auth/keys.d.tsView file

Lines 8-46typescript

8 * We use Node's built-in `crypto` module and `child_process` (ssh-keygen) to

9 * generate the key pair, matching the existing manual flow agents used to do.

10 */

11import crypto from "node:crypto";

12export interface KeyPair {

13 privateKeyFile: string;