registry / @shomra/agent / 0.2.8

@shomra/agent@0.2.8

Shomra — a local-first security scanner and runtime firewall for AI agents, MCP servers, prompts, and models. Gates AI artifacts in your editor and CI.

AI Security Review

scanned 2h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

User runs `shomra install-hook`, `shomra protect`, or an installed agent hook later invokes `shomra tool-guard`/`result-guard`.

Impact

Persistent interception of supported agent tool calls and possible transmission of scanned tool or discovery data to the configured Shomra backend.

Mechanism

Explicit coding-agent hook installation with optional configured-backend telemetry.

Rationale

Source inspection does not confirm malicious behavior or lifecycle abuse. Because explicit commands persistently modify AI-agent control surfaces and can route activity to a configured backend, this warrants a warning under the stated policy.

Evidence

package.jsonshomra.mjsdiscovery.mjsguard-signals.mjscode-sast.mjs~/.shomra/config.json~/.codex/hooks.json~/.claude/settings.json~/.gemini/settings.json~/.cursor/hooks.json~/.aider.conf.yml

Network endpoints1

api.github.com

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

`shomra.mjs` installs persistent Pre/Post tool hooks into coding-agent configs when `install-hook` or `protect` is run.
Installed hooks invoke `shomra tool-guard` and `result-guard`, inspect tool inputs/results, and may send policy-relevant data to a user-configured backend.
`discovery.mjs` reads local AI-tool configs and selected API-key environment variables; `report` can transmit discovery data after configuration.

Evidence against

`package.json` contains no `preinstall`, `install`, or `postinstall` lifecycle script.
Hook/config writes are reachable only through explicit CLI commands, not import-time behavior.
Backend URL and key are absent by default; `resolveSettings` makes remote reporting opt-in.
`discovery.mjs` only invokes fixed process-listing commands (`ps` or `tasklist`); no downloaded or dynamically executed payload was found.
The reported NUL bytes in `shomra.mjs` are an intentional temporary glob-conversion sentinel, not hidden executable content.
No bidi control bytes were found in `guard-signals.mjs`; its cloud-metadata and eval references are scanner detection patterns.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 5 file(s), 360 KB of source, external domains: 127.0.0.1, api.github.com, example.com, json.schemastore.org, shomra.dev

Source & flagged code

6 flagged

discovery.mjsView file

Lines 1-41javascript

1/**

2 * Cross-platform discovery of AI tooling on a developer machine. Pure Node

3 * built-ins. Each discoverer is best-effort and isolated — a missing or

4 * malformed file, a blocked process listing, or a slow walk never aborts the

5 * scan. Returns a flat list of assets in the shape the Shomra backend's

6 * /agent/report endpoint expects (types: MCP_SERVER | AI_TOOL | AI_RULES |

7 * MODEL_KEY | AI_AGENT).

8 *

9 * Detection layers:

10 * 1. Fixed global paths for known AI clients / coding agents / runtimes.

11 * 2. A bounded walk of the developer's real workspace — cwd plus the common

12 * project-parent dirs under $HOME (Desktop, repos, source, projects, …) —

13 * that finds project-local MCP configs, AI rules files, AI-SDK

14 * dependencies in manifests, and API keys sitting in .env files.

15 * 3. Local model runtimes (Ollama / LM Studio / Jan / GPT4All / HF cache)

16 * by directory AND by running process.

17 * 4. Model-provider API keys in the environment.

18 */

19import fs from 'node:fs';

20import path from 'node:path';

21import os from 'node:os';

22import { execFileSync } from 'node:child_process';

High

Child Process

Package source references child process execution.

discovery.mjsView on unpkg · L21

24const HOME = os.homedir();

25const APPDATA = process.env.APPDATA || path.join(HOME, 'AppData', 'Roaming');

26const LOCALAPPDATA = process.env.LOCALAPPDATA || path.join(HOME, 'AppData', 'Local');

27const PLAT = process.platform;

29/** VS Code (and forks) per-user dir, where extensions keep global state. */

30function vscodeUserDir(variant = 'Code') {

31 if (PLAT === 'win32') return path.join(APPDATA, variant, 'User');

32 if (PLAT === 'darwin') return path.join(HOME, 'Library', 'Application Support', variant, 'User');

33 return path.join(HOME, '.config', variant, 'User');

34}

36function readJson(file) {

37 try {

38 return JSON.parse(stripJsonComments(fs.readFileSync(file, 'utf8')));

39 } catch {

40 return null;

41 }

guard-signals.mjsView file

Lines 1-29javascript

1/**

2 * Tier-0 local guard signals — a dependency-free, high-confidence subset of the

3 * server-side detection engine, ported so the runtime firewall can decide the

4 * DANGEROUS majority of tool calls ON-BOX, with zero network round-trip.

5 *

6 * Why this exists: the pre-tool-call hook fires on every action. Routing every

7 * call through the backend put a network dependency on the hot path — slow when

8 * the backend was busy, and (fail-open) bypassable by simply making it

9 * unreachable. This module lets the guard block the unambiguously-malicious

10 * cases (curl|sh, reverse shells, base64 RCE, live secrets) locally and

11 * instantly, so protection survives a slow/down/blocked backend.

shomra.mjsView file

Lines 1-36javascript

1#!/usr/bin/env node

2/**

3 * Shomra agent — the developer-machine plugin for the Shomra AI Security

4 * Posture Management platform. Discovers the AI tooling on this machine

5 * (MCP servers, AI rules files, AI tools, model keys), and reports it to your

6 * Shomra org for analysis. Zero dependencies — Node built-ins only.

7 *

8 * shomra init --key shm_live_… --url <your backend> # connect to a Shomra org (optional)

9 * shomra scan # discover + analyze, print a local report

10 * shomra report # discover + send to the platform (alias: scan --report)

11 * shomra status # show config + enrollment

Source & flagged code

6 flagged · loading source

discovery.mjsView file

21import os from 'node:os'; L22: import { execFileSync } from 'node:child_process'; L23:

High

Child Process

Package source references child process execution.

discovery.mjsView on unpkg · L21

guard-signals.mjsView file

116contains invisible/control Unicode U+180E (mongolian vowel separator) export const INVISIBLE_CHARS_RE = /[؜ᅟᅠ<U+180E><U+200B><U+200C><U+200E><U+200F><U+202A>-<U+202E><U+2060>-⁤<U+2066>-<U+2069>ㅤ<U+FEFF>ﾠ￹-￻]|[\u{E0000}-\u{E007F}\u{E0100}-\u{E01EF}]/u;

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

guard-signals.mjsView on unpkg · L116

•Trigger-reachable chain: manifest.bin -> shomra.mjs -> guard-signals.mjs Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

guard-signals.mjsView on unpkg

9* unreachable. This module lets the guard block the unambiguously-malicious L10: * cases (curl|sh, reverse shells, base64 RCE, live secrets) locally and L11: * instantly, so protection survives a slow/down/blocked backend. ... L66: { name: 'Pipe-to-shell installer (curl … | sh)', re: /\b(curl|wget)\b[^\n|]{0,200}\|\s*(sudo\s+)?(ba|z|k)?sh\b/i, severity: 'CRITICAL' }, L67: { name: 'PowerShell download-and-run (iwr/curl … | iex)', re: /\b(iwr|curl|wget|invoke-webrequest|invoke-restmethod|irm)\b[^\n|]{0,200}\|\s*(iex|invoke-expression)\b/i, severity: '... L68: { name: 'Invoke-Expression of downloaded content', re: /\b(iex|invoke-expression)\b[^\n]{0,120}(downloadstring|net\.webclient|\(\s*(iwr|irm|invoke-)|\$\()/i, severity: 'CRITICAL' }... ... L73: { name: 'Fetches from a raw IP address', re: /\b(curl|wget|iwr|irm|invoke-webrequest|invoke-restmethod)\b[^\n]{0,220}https?:\/\/\d{1,3}(\.\d{1,3}){3}/i, severity: 'HIGH' }, L74: { name: 'Writes to shell profile / SSH keys / crontab', re: /(\.bashrc|\.zshrc|\.bash_profile|\.profile|authorized_keys|id_rsa\b|\bcrontab\b)/i, severity: 'HIGH' }, L75: { name: 'Recursive force delete (rm -rf)', re: /\brm\s+-[a-z]*r[a-z]*f|\brm\s+-[a-z]*f[a-z]

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

guard-signals.mjsView on unpkg · L9

75{ name: 'Recursive force delete (rm -rf)', re: /\brm\s+-[a-z]*r[a-z]*f|\brm\s+-[a-z]*f[a-z]*r/i, severity: 'HIGH', refine: rmTargetsRealData }, L76: // BARE `eval(`/`exec(` only — the lookbehind drops method calls that merely end L77: // in those letters (`db.exec(`, `RE.exec(`, `page.$eval(`, `$pdo->exec(`).

Low

Eval

Package source references a known benign dynamic code generation pattern.

guard-signals.mjsView on unpkg · L75

shomra.mjsView file

16Cross-file remote execution chain: shomra.mjs spawns guard-signals.mjs; helper contains network access plus dynamic code execution. L16: import crypto from 'node:crypto'; L17: import { execSync } from 'node:child_process'; L18: import { fileURLToPath } from 'node:url'; ... L23: L24: // Read from package.json rather than hardcoding: the two spellings drifted (this L25: // const said 0.2.0 while the package was already 0.2.4), so `shomra --version` ... L31: const here = path.dirname(fileURLToPath(import.meta.url)); L32: return JSON.parse(fs.readFileSync(path.join(here, 'package.json'), 'utf8')).version ?? '0.0.0'; L33: } catch { ... L36: })(); L37: const CONFIG_DIR = path.join(os.homedir(), '.shomra'); L38: const CONFIG_FILE = path.join(CONFIG_DIR, 'config.json');

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

shomra.mjsView on unpkg · L16

Findings

2 Critical4 High3 Medium5 Low

CriticalTrojan Source Unicodeguard-signals.mjs

CriticalTrigger Reachable Dangerous Capabilityguard-signals.mjs

HighChild Processdiscovery.mjs

HighShell

HighCloud Metadata Accessguard-signals.mjs

HighCross File Remote Execution Contextshomra.mjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvalguard-signals.mjs

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

6 flagged

discovery.mjsView file

Lines 1-41javascript

1/**

2 * Cross-platform discovery of AI tooling on a developer machine. Pure Node

3 * built-ins. Each discoverer is best-effort and isolated — a missing or

4 * malformed file, a blocked process listing, or a slow walk never aborts the

5 * scan. Returns a flat list of assets in the shape the Shomra backend's

6 * /agent/report endpoint expects (types: MCP_SERVER | AI_TOOL | AI_RULES |

7 * MODEL_KEY | AI_AGENT).

8 *

9 * Detection layers:

10 * 1. Fixed global paths for known AI clients / coding agents / runtimes.

11 * 2. A bounded walk of the developer's real workspace — cwd plus the common

12 * project-parent dirs under $HOME (Desktop, repos, source, projects, …) —

13 * that finds project-local MCP configs, AI rules files, AI-SDK

14 * dependencies in manifests, and API keys sitting in .env files.

15 * 3. Local model runtimes (Ollama / LM Studio / Jan / GPT4All / HF cache)

16 * by directory AND by running process.

17 * 4. Model-provider API keys in the environment.

18 */

19import fs from 'node:fs';

20import path from 'node:path';

21import os from 'node:os';

22import { execFileSync } from 'node:child_process';

High

Child Process

Package source references child process execution.

discovery.mjsView on unpkg · L21

24const HOME = os.homedir();

25const APPDATA = process.env.APPDATA || path.join(HOME, 'AppData', 'Roaming');

26const LOCALAPPDATA = process.env.LOCALAPPDATA || path.join(HOME, 'AppData', 'Local');

27const PLAT = process.platform;

29/** VS Code (and forks) per-user dir, where extensions keep global state. */

30function vscodeUserDir(variant = 'Code') {

31 if (PLAT === 'win32') return path.join(APPDATA, variant, 'User');

32 if (PLAT === 'darwin') return path.join(HOME, 'Library', 'Application Support', variant, 'User');

33 return path.join(HOME, '.config', variant, 'User');

34}

36function readJson(file) {

37 try {

38 return JSON.parse(stripJsonComments(fs.readFileSync(file, 'utf8')));

39 } catch {

40 return null;

41 }

guard-signals.mjsView file

Lines 1-29javascript

1/**

2 * Tier-0 local guard signals — a dependency-free, high-confidence subset of the

3 * server-side detection engine, ported so the runtime firewall can decide the

4 * DANGEROUS majority of tool calls ON-BOX, with zero network round-trip.

5 *

6 * Why this exists: the pre-tool-call hook fires on every action. Routing every

7 * call through the backend put a network dependency on the hot path — slow when

8 * the backend was busy, and (fail-open) bypassable by simply making it

9 * unreachable. This module lets the guard block the unambiguously-malicious

10 * cases (curl|sh, reverse shells, base64 RCE, live secrets) locally and

11 * instantly, so protection survives a slow/down/blocked backend.

shomra.mjsView file

Lines 1-36javascript

1#!/usr/bin/env node

2/**

3 * Shomra agent — the developer-machine plugin for the Shomra AI Security

4 * Posture Management platform. Discovers the AI tooling on this machine

5 * (MCP servers, AI rules files, AI tools, model keys), and reports it to your

6 * Shomra org for analysis. Zero dependencies — Node built-ins only.

7 *

8 * shomra init --key shm_live_… --url <your backend> # connect to a Shomra org (optional)

9 * shomra scan # discover + analyze, print a local report

10 * shomra report # discover + send to the platform (alias: scan --report)

11 * shomra status # show config + enrollment

Lines 55-136javascript

55 if (!sig.refine) return sig.re.test(text);

56 const g = new RegExp(sig.re.source, sig.re.flags.includes('g') ? sig.re.flags : sig.re.flags + 'g');

57 for (const m of text.matchAll(g)) {

58 if (m.index == null) continue;

59 if (sig.refine(lineTextAt(text, m.index))) return true;

60 }

61 return false;

62}

64// ── dangerous shell ──

65export const DANGEROUS_SHELL = [

66 { name: 'Pipe-to-shell installer (curl … | sh)', re: /\b(curl|wget)\b[^\n|]{0,200}\|\s*(sudo\s+)?(ba|z|k)?sh\b/i, severity: 'CRITICAL' },

67 { name: 'PowerShell download-and-run (iwr/curl … | iex)', re: /\b(iwr|curl|wget|invoke-webrequest|invoke-restmethod|irm)\b[^\n|]{0,200}\|\s*(iex|invoke-expression)\b/i, severity: 'CRITICAL' },

68 { name: 'Invoke-Expression of downloaded content', re: /\b(iex|invoke-expression)\b[^\n]{0,120}(downloadstring|net\.webclient|\(\s*(iwr|irm|invoke-)|\$\()/i, severity: 'CRITICAL' },

69 { name: 'Reverse shell via /dev/tcp', re: /\/dev\/(tcp|udp)\//i, severity: 'CRITICAL' },

70 { name: 'Base64 blob piped to a shell', re: /base64\s+(--?d(ecode)?)?\b[^\n|]{0,200}\|\s*(ba|z)?sh\b/i, severity: 'CRITICAL' },

71 { name: 'curl/wget posts data to the network (exfiltration)', re: /\b(curl|wget|http|https|invoke-restmethod|irm)\b[^\n]{0,220}(--data(-raw|-binary|-urlencode)?|--form\b|--upload-file\b|(^|\s)-d\s|(^|\s)-F\s|(^|\s)-T\s|-Method

72 { name: 'Command output piped into a network call', re: /\b(curl|wget|invoke-restmethod|invoke-webrequest|irm|iwr)\b[^\n]{0,220}(\$\(|`[^`\n]+`|<\()/i, severity: 'HIGH' },

73 { name: 'Fetches from a raw IP address', re: /\b(curl|wget|iwr|irm|invoke-webrequest|invoke-restmethod)\b[^\n]{0,220}https?:\/\/\d{1,3}(\.\d{1,3}){3}/i, severity: 'HIGH' },

74 { name: 'Writes to shell profile / SSH keys / crontab', re: /(\.bashrc|\.zshrc|\.bash_profile|\.profile|authorized_keys|id_rsa\b|\bcrontab\b)/i, severity: 'HIGH' },

75 { name: 'Recursive force delete (rm -rf)', re: /\brm\s+-[a-z]*r[a-z]*f|\brm\s+-[a-z]*f[a-z]*r/i, severity: 'HIGH', refine: rmTargetsRealData },

76 // BARE `eval(`/`exec(` only — the lookbehind drops method calls that merely end

77 // in those letters (`db.exec(`, `RE.exec(`, `page.$eval(`, `$pdo->exec(`).

Low

Eval

Package source references a known benign dynamic code generation pattern.

guard-signals.mjsView on unpkg · L75

78 { name: 'Inline eval / exec of a string', re: /(?<![.\w$>:])(eval|exec)\s*[("`']/i, severity: 'HIGH' },

79 { name: 'Pipes an env dump to the network', re: /\b(env|printenv|set)\b[^\n|]{0,80}\|[^\n]{0,80}(curl|wget|nc\b|http)/i, severity: 'HIGH' },

80 { name: 'Disables TLS / cert verification', re: /(NODE_TLS_REJECT_UNAUTHORIZED\s*=\s*0|GIT_SSL_NO_VERIFY|--no-check-certificate|--insecure\b|verify\s*=\s*False)/i, severity: 'MEDIUM' },

81 { name: 'python -c one-liner', re: /python[0-9.]*\s+-c\b/i, severity: 'MEDIUM' },

82 { name: 'node -e one-liner', re: /\bnode\s+-e\b/i, severity: 'MEDIUM' },

83 { name: 'Netcat / socket exfil', re: /\bnc\s+-[a-z]*\b|\bncat\b/i, severity: 'MEDIUM' },

84];

86// ── injection ──

87// Broad phrases that dominate benign dev prose ("system prompt", "run the

88// following command", "do not tell the user", "never mention") are deliberately

89// excluded — their real-attack shapes are caught by scanShell and the tightened

90// regexes below. The injection loop also applies PRECEDING_NEGATION, so "never

91// ignore previous instructions" reads as legitimate.

92export const INJECTION_PHRASES = [

93 'ignore previous instructions', 'ignore all previous', 'disregard previous', 'disregard the above',

94 'without informing the user', 'without telling the user',

95 'new instructions:', 'override your', 'exfiltrate',

96 'send them to', 'post them to',

97 'run this first', 'copy and run', 'seed the current host',

98 'ignore all instructions', 'ignore your instructions', 'ignore your safety', 'ignore all content policies',

99 'disregard your instructions', 'disregard the guidelines', 'system override', 'follow only my instructions',

100 'do anything now', 'reveal any credential',

101 'save this to your memory', 'in all future sessions', 'remember this forever',

102];

103export const INJECTION_REGEXES = [

104 { label: 'Instruction-override phrasing', re: /\b(ignore|disregard|override|bypass|circumvent)\b[\s\w,'"()-]{0,40}?\b(instruction|instructions|directive|directives|safety|safeguards?|guardrails?|system\s+prompt|content\s+polic\w+)\b/i },

105 { label: 'Instructs the agent to conceal an action from the user', re: /\b(?:do\s*n['o]?t|never|without)\s+(?:tell|telling|inform|informing|notify|notifying|alert|alerting|mention|mentioning|disclos\w+|reveal\w*)\s+(?:it\s

106 { label: 'Bulk destructive command', re: /\b(delete|remove|wipe|erase|destroy|drop|purge|nuke|truncate)\b[\s\w,'"()-]{0,20}?\b(all|every|each|entire|whole)\b[\s\w,'"()-]{0,15}?\b(folder|folders|file|files|directory|directories|

107 { label: 'Destructive SQL statement', re: /\b(drop|truncate)\s+(table|database|schema)\b/i },

108];

109// Negation flips an override phrase into a hardening rule; a bulk-destructive hit

110// on a build/test artifact is a clean step, not an attack. Applied in localScan.

113// zero-width / bidi / tag-block chars used to smuggle instructions (ASCII smuggling).

114// Excludes U+200D ZWJ and U+FE00–FE0F variation selectors — those render ordinary

115// emoji ("⚠️", "👨‍💻") and are not a smuggling channel.

116export const INVISIBLE_CHARS_RE = /[؜ᅟᅠ᠎‌‎‏‪-‮⁠-⁤⁦-⁩ㅤﾠ￹-￻]|[\u{E0000}-\u{E007F}\u{E0100}-\u{E01EF}]/u;

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

guard-signals.mjsView on unpkg · L116

117

118// ── secrets ──

119export const SECRET_PATTERNS = [

120 // Prefix-style keys are \b-anchored (backend parity, checks/patterns.ts): a

121 // slug that merely CONTAINS the prefix ("task-0123456789abcdefghij",

122 // "disk-…") must not read as a live credential — these are CRITICAL and BLOCK.

123 { name: 'Stripe live key', re: /\bsk_live_[0-9a-zA-Z]{16,}/ },

124 { name: 'OpenAI key', re: /\bsk-[A-Za-z0-9]{20,}/ },

125 { name: 'AWS access key id', re: /\bAKIA[0-9A-Z]{16}/ },

126 { name: 'GitHub token', re: /ghp_[0-9A-Za-z]{20,}/ },

127 { name: 'Slack token', re: /xox[baprs]-[0-9A-Za-z-]{10,}/ },

128 { name: 'Generic bearer', re: /bearer\s+[A-Za-z0-9._-]{20,}/i },

129 { name: 'Private key block', re: /-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----/ },

130];

131

132export const RISKY_CONFIG_MARKERS = [

133 'yolo', 'auto-approve', 'autoapprove', 'auto_approve', 'autorun', 'auto-run',

134 'always allow', 'alwaysallow', 'dangerously', 'skip confirmation', 'no confirmation',

135 'disable safety', 'bypass approval', 'full access', 'unrestricted',

136];