registry / @sofagent/audit / 1.0.0

@sofagent/audit@1.0.0

sofagent 提交时审计——扫描 git diff，检查 Agent 是否遵守工作纪律

AI Security Review

scanned 10h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. No install-time execution or confirmed covert exfiltration is present. Explicit CLI initialization can create a project `.sofagent/config.yml` and replace a Git pre-commit hook; optional webhook delivery sends audit results to a user-configured endpoint.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User runs `sofagent-audit --init`, `--install-hook`, or enables `--webhook`/`--webhook-url`.

Impact

A requested setup command can alter the current repository hook and configuration; configured webhooks can receive audit warning text.

Mechanism

User-invoked Git-hook setup and optional audit-result webhook POST.

Rationale

Source inspection does not support a malicious verdict, but explicit setup mutates a Git lifecycle hook and optional webhook reporting can export audit output. Treat as a transparent, user-invoked lifecycle-risk capability rather than malware.

Evidence

package.jsondist/index.jsdist/commands/init.jsdist/webhook.jsdist/verify/checks.jsdist/env-check.jsdist/rules/skill-safety-rules.jshooks/pre-commit.sofagent/config.yml.git/hooks/pre-commit

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

`dist/commands/init.js` writes `.git/hooks/pre-commit` when the user runs `--init`.
`dist/index.js` exposes explicit `--install-hook` and webhook options.
`dist/webhook.js` POSTs audit warning details to a user-supplied URL or `SOFAGENT_WEBHOOK_URL`.

Evidence against

`package.json` has only `prepublishOnly`; no install-time lifecycle hook.
`dist/webhook.js` sends only when the user enables a webhook and supplies/configures its URL.
`dist/commands/init.js` runs only through explicit CLI initialization and writes project-local `.sofagent` plus Git hook paths.
`dist/env-check.js` and `dist/commands/doctor.js` use commands for environment/health checks, not payload execution.
`dist/rules/skill-safety-rules.js` contains detection regexes for `eval`/`Function`, not dynamic execution.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 50 file(s), 271 KB of source, external domains: github.com, nodejs.org, registry.npmjs.org

Source & flagged code

4 flagged

dist/env-check.jsView file

Lines 1-26javascript

1#!/usr/bin/env node

2"use strict";

3// env-check.ts · FDE 环境验证 CLI — v1.0.0

4// 用法: sofagent-env-check [--json]

5Object.defineProperty(exports, "__esModule", { value: true });

6exports.checkEnv = checkEnv;

7const child_process_1 = require("child_process");

8const fs_1 = require("fs");

High

Child Process

Package source references child process execution.

dist/env-check.jsView on unpkg · L6

9const path_1 = require("path");

10const os_1 = require("os");

11const constants_js_1 = require("./shared/constants.js");

12const R = '\x1b[31m', G = '\x1b[32m', Y = '\x1b[33m', N = '\x1b[0m', D = '\x1b[2m';

13const C = (ok) => ok ? `${G}✓${N}` : `${R}✗${N}`;

14function checkEnv() {

15 const nodeVersion = process.version;

16 const nodeMajor = parseInt(nodeVersion.slice(1).split('.')[0], 10);

17 let gitAvail = false, gitRepo = false;

18 try {

19 (0, child_process_1.execFileSync)('git', ['--version'], { stdio: 'pipe' });

20 gitAvail = true;

21 }

22 catch { /* */ }

23 if (gitAvail) {

24 try {

25 (0, child_process_1.execFileSync)('git', ['rev-parse', '--git-dir'], { stdio: 'pipe' });

26 gitRepo = true;

dist/rules/skill-safety-rules.jsView file

Lines 16-56javascript

16 // === 恶意命令 (DANGEROUS) ===

17 { pattern: /(^|[^a-zA-Z0-9_])rm\s+-rf\s+\//, category: '恶意命令', severity: 'DANGEROUS', description: 'rm -rf / 危险删除' },

18 { pattern: /curl

dist/verify/checks.jsView file

Lines 280-320javascript

280 else {

281 v.checkWarn('handler.ts 回归：sofagent-load-chain hook 在最近日志中未检测到触发');

282 }

283 }

284 else {

285 v.checkWarn('handler.ts 回归：最近 30 天无 OpenClaw 日志，跳过');

286 }

287 }

288

dist/commands/doctor.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @sofagent/audit@0.99.8 matchedIdentity = npm:QHNvZmFnZW50L2F1ZGl0:0.99.8 similarity = 0.857 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/commands/doctor.jsView on unpkg

Source & flagged code

4 flagged · loading source

dist/env-check.jsView file

6exports.checkEnv = checkEnv; L7: const child_process_1 = require("child_process"); L8: const fs_1 = require("fs");

High

Child Process

Package source references child process execution.

dist/env-check.jsView on unpkg · L6

dist/rules/skill-safety-rules.jsView file

36// === 危险调用 (SUSPICIOUS) === L37: { pattern: /eval$.*[^0-9"'].*$/, category: '危险调用', severity: 'SUSPICIOUS', description: 'eval() 非常量参数' }, L38: { pattern: /os\.system\(/, category: '危险调用', severity: 'SUSPICIOUS', description: 'os.system() 系统调用' },

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/rules/skill-safety-rules.jsView on unpkg · L36

dist/verify/checks.jsView file

300// ao compose 健康检查 L301: const aoComposeOut = (0, utils_js_1.tryExec)('ao', ['compose', '--version']); L302: if (aoComposeOut) { ... L314: if (aoMajor === 0 && (aoMinor < 7 || (aoMinor === 7 && aoPatch < 5))) { L315: v.checkWarn(`ao 版本低于 0.7.5（当前 ${aoVer}），建议升级：npm install -g agency-orchestrator@0.7.5`); L316: }

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/verify/checks.jsView on unpkg · L300

dist/commands/doctor.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/commands/doctor.jsView on unpkg

Findings

1 Critical2 High3 Medium6 Low

CriticalPrevious Version Dangerous Deltadist/commands/doctor.js

HighChild Processdist/env-check.js

HighRuntime Package Installdist/verify/checks.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvaldist/rules/skill-safety-rules.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

90%Warn

Verdict confidence

IntentDangerous Capability

TypeAgent extension lifecycle risk

False-positive riskLow

Review stagesource_first_review

Firewall policyWarn-only agent extension risk

Package metadata

npm

AuthorKongFangXun

Maintainerskongfangxun

Version1.0.1

PublishedJul 10, 2026

LicenseMIT

Dependencies1

Integrityverified

Package size86.7 KB

Files103

Keywordssofagentauditgitagentdisciplinemcpmodel-context-protocol

LinksRepository Homepage Issues

Runtime surface

package.json

Entrypointsmain → dist/index.jstypes → dist/public-api.d.tsexports mapbin → skill-safety-check, sofagent-audit, sofagent-env-check +5

Runtimenode >=18

Artifact317 KB · 103 files1 signature(s)

Install lifecycleprepublishOnly

Behavioral surface

ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkHighEntropyStringsUrlStringsManifest: clean

Source & flagged code

4 flagged

dist/env-check.jsView file

Lines 1-26javascript

1#!/usr/bin/env node

2"use strict";

3// env-check.ts · FDE 环境验证 CLI — v1.0.0

4// 用法: sofagent-env-check [--json]

5Object.defineProperty(exports, "__esModule", { value: true });

6exports.checkEnv = checkEnv;

7const child_process_1 = require("child_process");

8const fs_1 = require("fs");

High

Child Process

Package source references child process execution.

dist/env-check.jsView on unpkg · L6

9const path_1 = require("path");

10const os_1 = require("os");

11const constants_js_1 = require("./shared/constants.js");

12const R = '\x1b[31m', G = '\x1b[32m', Y = '\x1b[33m', N = '\x1b[0m', D = '\x1b[2m';

13const C = (ok) => ok ? `${G}✓${N}` : `${R}✗${N}`;

14function checkEnv() {

15 const nodeVersion = process.version;

16 const nodeMajor = parseInt(nodeVersion.slice(1).split('.')[0], 10);

17 let gitAvail = false, gitRepo = false;

18 try {

19 (0, child_process_1.execFileSync)('git', ['--version'], { stdio: 'pipe' });

20 gitAvail = true;

21 }

22 catch { /* */ }

23 if (gitAvail) {

24 try {

25 (0, child_process_1.execFileSync)('git', ['rev-parse', '--git-dir'], { stdio: 'pipe' });

26 gitRepo = true;

dist/rules/skill-safety-rules.jsView file

Lines 16-56javascript

16 // === 恶意命令 (DANGEROUS) ===

17 { pattern: /(^|[^a-zA-Z0-9_])rm\s+-rf\s+\//, category: '恶意命令', severity: 'DANGEROUS', description: 'rm -rf / 危险删除' },

18 { pattern: /curl

dist/verify/checks.jsView file

Lines 280-320javascript

280 else {

281 v.checkWarn('handler.ts 回归：sofagent-load-chain hook 在最近日志中未检测到触发');

282 }

283 }

284 else {

285 v.checkWarn('handler.ts 回归：最近 30 天无 OpenClaw 日志，跳过');

286 }

287 }

288

dist/commands/doctor.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/commands/doctor.jsView on unpkg