@provectus/awos-recruitment@0.1.6
AI Security Review
scanned 1d ago · by lpm-firewall-aiThe package’s agent and skill installation behavior matches its CLI purpose, and no install-time attack was identified. However, ordinary status and update commands send runtime telemetry by default, including a persistent random project ID and, for removed skills, capability names, so this warrants a warning.
Static reason
No blocking static signals were detected.
Trigger
A user runs skill status or skill update in a project with a lock file.
Impact
The service can associate project activity with a persistent random ID and may receive names of removed skills.
Mechanism
The CLI POSTs a random project ID and update events to the service; sending can be disabled with AWOS_TELEMETRY=0.
AI rationale
The package’s agent and skill installation behavior matches its CLI purpose, and no install-time attack was identified. However, ordinary status and update commands send runtime telemetry by default, including a persistent random project ID and, for removed skills, capability names, so this warrants a warning.
Evidence
dist/lib/telemetry.jsdist/commands/skill-status.jsdist/commands/skill-update.jsdist/lib/lock.js
Network endpoints1
recruitment.awos.provectus.pro/telemetry
Decision evidence
public snapshotAI called this Suspicious at 92.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The package exposes a CLI and has only a prepublishOnly build hook, not an install lifecycle hook.
- Running skill status sends telemetry automatically when a project lock file exists.
- Telemetry is disabled only when AWOS_TELEMETRY is set to "0"; the POST includes a project ID and event data.
- Events for removed skills include the skill name.
- The project ID is generated as a random UUID.
- The default telemetry service is recruitment.awos.provectus.pro.
Evidence against
- The CLI’s agent installation writes into the project’s .claude/agents directory as part of an explicit install command.
- The reviewed telemetry code sends project IDs and update events; no credential or file-content collection was identified.
Behavioral surface
CryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
4 flaggeddist/commands/agent.jsView file
•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation.
export async function installagents(names) {
const serverurl = resolveserverurl();
const agenttempdir = await downloadbundle(`${serverurl}/bundle/agents`, names);
let agentresults;
try {
agentresults = processagents(agenttempdir, names);
}
finally {
fs.rmsync(agenttempdir, { recursive: true, force: true });
}
const skillresults = await installreferencedskills(agentresults, serverurl);
High
Trigger Reachable External Ai Agent Control Surface Mutation
Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.
dist/commands/agent.jsView on unpkgpackage.jsonView file
17"scripts": {
"build": "tsc -p tsconfig.build.json",
"test": "vitest run",
"lint": "tsc --noEmit",
"prepublishOnly": "npm run build"
},
"dependencies": {
"tar": "^7.
Medium
Suspicious Lifecycle Evidence
Findings
1 High5 Medium6 Low
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/commands/agent.js
MediumNetwork
MediumEnvironment Vars
MediumSuspicious Lifecycle Evidencepackage.json
MediumAi Review Evidencedist/commands/skill-status.js
MediumAi Review Evidencedist/lib/telemetry.js
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @provectus/awos-recruitment@0.1.6.
See all versions of @provectus/awos-recruitment for other recorded verdicts.
- Review the evidence and your use of @provectus/awos-recruitment@0.1.6 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.