@saltpub/xiaojiu-agent-bridge@0.1.7
Bridge Xiaojiu IM with local CLI coding agents
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe CLI sends full user prompts through its default runtime telemetry path, and the source explicitly names this field to avoid the redaction rule. This is undisclosed excess collection, so it warrants a warning; the inspected source does not establish a malicious credential-theft or unrelated-collector attack.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
The bridge starts and processes a message for a coding-agent run.
Impact
Prompts sent through the bridge may also be sent to the telemetry service, along with app and machine identifiers.
Mechanism
The CLI logs the full prompt as `agentPrompt` and passes non-envelope fields from the sanitized log entry to its default telemetry adapter. The adapter’s endpoint was not available in the inspected source.
AI rationale
The CLI sends full user prompts through its default runtime telemetry path, and the source explicitly names this field to avoid the redaction rule. This is undisclosed excess collection, so it warrants a warning; the inspected source does not establish a malicious credential-theft or unrelated-collector attack.
Evidence
dist/cli.jspackage.json
Decision evidence
public snapshotAI called this Suspicious at 94.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The CLI loads the default telemetry adapter during normal startup; an environment variable can disable it.
- When building work for the coding agent, the CLI logs the full prompt, capped at 8 KiB, under `agentPrompt`; the source comment says this key avoids the prompt redaction rule.
- The telemetry path sends fields from the externally sanitized log entry. That sanitizer redacts the exact key `prompt`, but not `agentPrompt`.
- Startup telemetry metadata includes the Xiaojiu app ID and machine hostname.
Evidence against
- The package is a bridge that sends Xiaojiu messages to local coding-agent CLIs, so prompts are used by its core feature.
- The inspected source does not reveal the telemetry dependency’s network endpoint.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
6 flaggeddist/cli.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @saltpub/xiaojiu-agent-bridge@0.1.5
matchedIdentity = npm:[redacted]:0.1.5
similarity = 0.750
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/cli.jsView on unpkg24import crossSpawn from "cross-spawn";
L25: import { execFile } from "child_process";
L26: function spawnProcess(command, args = [], options = {}) {
High
3import { join } from "path";
L4: if (!process.env.XIAOJIU_BRIDGE_HOME && process.env.npm[redacted] === "cli") {
L5: const localHome = join(process.cwd(), ".xiaojiu");
L6: if (existsSync(join(localHome, "config.json"))) {
...
L17: import { fileURLToPath } from "url";
L18: var packageJsonPath = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..", "package.json");
L19: var manifest = JSON.parse(readFileSync(packageJsonPath, "utf8"));
L20: var packageName = manifest.name;
...
L24: import crossSpawn from "cross-spawn";
L25: import { execFile } from "child_process";
L26: function spawnProcess(command, args = [], options = {}) {
...
L87: let settled = false;
Findings
1 Critical3 High4 Medium6 Low
CriticalPrevious Version Dangerous Deltadist/cli.js
HighChild Processdist/cli.js
HighCommand Output Exfiltrationdist/cli.js
HighCross File Remote Execution Contextdist/launcher.js
MediumDynamic Requiredist/cli.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowWeak Cryptodist/cli.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @saltpub/xiaojiu-agent-bridge@0.1.7.
See all versions of @saltpub/xiaojiu-agent-bridge for other recorded verdicts.
- Review the evidence and your use of @saltpub/xiaojiu-agent-bridge@0.1.7 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.