registry / @spotify/backstage-plugin-soundcheck-backend / 0.29.0

@spotify/backstage-plugin-soundcheck-backend@0.29.0

Ensure quality, reliability and alignment of software development with codified checks and guidance.

AI Security Review

scanned 8h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

No blocking static signals were detected.

Trigger

An authenticated caller invokes GraphQL `createHonkSession` (or an authorized `create-honk-session` action) after Honk is configured.

Impact

An insufficiently authorized caller may initiate repository-changing AI-agent work through the configured Honk service.

Mechanism

Configured API calls create an autonomous coding-agent session that can clone a repository, make changes, and open a pull request.

Rationale

The package is not malicious install-time code, but it contains a configured autonomous repository-modification capability exposed through a GraphQL mutation lacking an in-resolver permission check. Downgrade to a warning pending confirmation that GraphQL routing or upstream policy enforces equivalent authorization.

Evidence

package.jsondist/llm/LLMService.cjs.jsdist/graphql/resolvers/llm/resolvers.cjs.jsdist/actions/createCreateHonkSessionAction.cjs.jsdist/plugin.cjs.js

Network endpoints1

api.openai.com/v1

@spotify/backstage-plugin-soundcheck-backend@0.29.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code