registry  /  @sellable/admin-mcp  /  0.1.29

@sellable/admin-mcp@0.1.29

Sellable Admin MCP - cross-workspace operations and fulfillment tools

AI Security Review

scanned 11h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason
One or more suspicious static signals were detected.
Trigger
User launches the MCP server and calls `setup_hermes_onboarding_agent` with an approved apply/disable request.
Impact
Can configure or roll back a package-aligned Hermes/Slack agent; no unconsented lifecycle mutation or exfiltration was confirmed.
Mechanism
Explicit MCP-controlled agent provisioning through a PATH-resolved external installer and state-registry writes.
Rationale
The package is not malicious by static source evidence, but it exposes an explicit runtime capability to provision an AI/Slack agent through an external installer. This warrants a warning rather than a publish block because no lifecycle-triggered foreign control-surface mutation or concrete malicious chain was found.
Evidence
package.jsondist/index.jsdist/server.jsdist/tools/hermesOnboardingAgent.jsdist/auth.jsdist/api.jsdist/paths.js
Network endpoints2
app.sellable.devslack.com/api/${method}

Decision evidence

public snapshot
AI called this Suspicious at 88.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
  • `dist/tools/hermesOnboardingAgent.js` exposes an MCP tool that provisions/rolls back a Hermes agent.
  • The tool resolves and executes `sellable-admin-install` from `PATH` via `execFile`.
  • Apply/disable require `approved: true`; the tool can update admin state/agent registry.
  • `dist/server.js` activates these capabilities when the MCP server is explicitly launched.
Evidence against
  • `package.json` has no `preinstall`, `install`, `postinstall`, or `prepare` hook.
  • No dynamic evaluation, remote code loading, or embedded payload was found.
  • The flagged secret patterns redact output and reject secret values in tool arguments.
  • Network calls are authenticated product/Slack API operations, not discovered exfiltration endpoints.
Behavioral surface
Source
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
Supply chain
HighEntropyStringsUrlStrings
ManifestNo manifest risk signals triggered.
scanned 23 file(s), 255 KB of source, external domains: 127.0.0.1, app.sellable.dev, slack.com, www.googleapis.com

Source & flagged code

2 flagged · loading source
dist/tools/hermesOnboardingAgent.jsView file
16patternName = private_key_rsa severity = critical line = 16 matchedText = /-----BE...-/i,
Critical
Critical Secret

Package contains a critical-looking secret pattern.

dist/tools/hermesOnboardingAgent.jsView on unpkg · L16
16patternName = private_key_rsa severity = critical line = 16 matchedText = /-----BE...-/i,
Critical
Secret Pattern

RSA private key in dist/tools/hermesOnboardingAgent.js

dist/tools/hermesOnboardingAgent.jsView on unpkg · L16

Findings

2 Critical2 Medium4 Low
CriticalCritical Secretdist/tools/hermesOnboardingAgent.js
CriticalSecret Patterndist/tools/hermesOnboardingAgent.js
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings