registry / @rallycry/conveyor-agent / 11.1.3
@rallycry/conveyor-agent@11.1.3
Conveyor Agent Runner v10 - PTY harness for the task chat (SDK harness for audit/project-chat). Agent-as-User architecture with BaseService patterns. Works locally too.
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe high-risk scanner labels did not establish malicious behavior in the inspected source. The publish hook is build-only, credential handling stays within workspace paths, and the agent settings are created for an invoked PTY session with a plan-mode gate.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
Workspace boot wires existing workspace credentials; starting a PTY session creates its temporary hook settings.
Impact
These behaviors enable workspace authentication and agent sessions. The inspected source does not establish unauthorized credential transfer, persistence, or other attack behavior.
Mechanism
The boot helper copies and relinks a Claude credentials file. The PTY harness writes settings and hooks to a session-specific temporary directory, with plan mode gating tools when selected.
AI rationale
The high-risk scanner labels did not establish malicious behavior in the inspected source. The publish hook is build-only, credential handling stays within workspace paths, and the agent settings are created for an invoked PTY session with a plan-mode gate.
Decision evidence
public snapshotAI called this Clean at 83.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json exposes the agent commands and sets prepublishOnly to the build command `tsup`.
- dist/boot-3FWYGHSN.js copies an existing workspace Claude credential file to a pod-local path, then relinks it; boot setup calls this helper.
- dist/chunk-V5WR2F2P.js fetches a missing `.claude/grimoire` submodule only when the workspace declares it and a GitHub token is available.
- dist/chunk-VXGZSCRL.js stores transcripts under the Claude project path and creates hook settings in a temporary `conveyor-pty-` session directory.
- The PTY settings auto-approve tool calls, while plan mode retains its tool gate; the caller enables that gate when permission mode is `plan`.
- The inspected connection subscriptions, query-cache focus/online handlers, and watchdog configuration show ordinary runtime behavior.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket
Source & flagged code
8 flagged · loading sourcedist/chunk-VXGZSCRL.jsView file
3798* adapters have no trusted event source and skip it entirely. Returns the
L3799: * paths spawn() must wire into the child's argv/env.
L3800: */
High
Child Process
Package source references child process execution.
dist/chunk-VXGZSCRL.jsView on unpkg · L3798415Cross-file remote execution chain: dist/chunk-VXGZSCRL.js spawns dist/chunk-MILKMRPU.js; helper contains network access plus dynamic code execution.
L415: event: async ({ event }) => {
L416: const sink = process.env.${OPENCODE_EVENTS_FILE_ENV};
L417: if (!sink || !event || event.type === "message.part.delta") return;
...
L438: try {
L439: return JSON.parse(trimmed);
L440: } catch {
...
L533: }
L534: function buildResultEvent(exitCode, usage, assistantText, stderrTail, reportedError) {
L535: if (exitCode === 0) {
...
L1043: await this.readOnce();
L1044: this.buffer += this.decoder.end();
L1045: if (this.buffer.length > 0) {
High
Cross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
dist/chunk-VXGZSCRL.jsView on unpkg · L415•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 1
Findings
2 Critical6 High4 Medium5 Low
CriticalPersistence Backdoordist/boot-3FWYGHSN.js
CriticalTrigger Reachable Dangerous Capabilitydist/boot-3FWYGHSN.js
HighChild Processdist/chunk-VXGZSCRL.js
HighShell
HighCross File Remote Execution Contextdist/chunk-VXGZSCRL.js
HighTrigger Reachable Persistencedist/boot-3FWYGHSN.js
HighSemantic Analysis Limiteddist/chunk-VXGZSCRL.js
HighKnown Malware Source Similaritydist/chunk-6W6UZ4SJ.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperruntime/entrypoint.sh
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
Affected versions and remediation
This report applies to @rallycry/conveyor-agent@11.1.3.
See all versions of @rallycry/conveyor-agent for other recorded verdicts.
- Review the evidence and your use of @rallycry/conveyor-agent@11.1.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.