registry / @tianshu-ai/tianshu / 0.4.28

@tianshu-ai/tianshu@0.4.28

An open AI agent platform with a sidecar browser. Built in public.

AI Security Review

scanned 4d ago · by lpm-firewall-ai

No confirmed malicious attack surface was found by source inspection. Dangerous primitives are explicit AI-agent platform features activated by user commands or plugin setup, with visible sandbox/network/file boundaries.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User runs tianshu commands, enables plugins, or uses agent tools.

Impact

No evidence of unconsented install-time execution, credential harvesting, exfiltration, persistence, or AI-agent control-surface mutation.

Mechanism

Package-aligned CLI, sandbox, web fetch, setup, and WeChat channel functionality.

Rationale

Static source inspection shows an AI agent platform with explicit user-invoked sandbox, web-fetch, service setup, and messaging capabilities; the scanner findings map to documented functionality rather than covert behavior. No lifecycle hook, import-time payload, credential harvesting, or unconsented persistence/exfiltration path was confirmed.

Evidence

package.jsonbin/tianshu.mjsplugins/web-search/dist/tools/web-fetch.jsplugins/openshell/dist/runner/openshell-runner.jsplugins/openshell/dist/runner/gateway-manager.jspackages/server/dist/setup/start-server.jspackages/server/dist/setup/launchd.jspackages/server/dist/setup/service.jsplugins/wechat/dist/ilink-media.js

Decision evidence

public snapshot

AI called this Clean at 87.0% confidence as Benign with low false-positive risk.

Evidence for block

Evidence against

package.json has no install/postinstall hook; prepublishOnly only runs before publishing.
bin/tianshu.mjs is a minimal CLI shim importing packages/server/dist/cli.js.
plugins/web-search/dist/tools/web-fetch.js explicitly blocks localhost, private ranges, link-local, and metadata hosts before fetch and after redirect.
plugins/openshell/dist/runner/openshell-runner.js provides user-invoked sandbox exec/file sync with path traversal checks, not install-time execution.
packages/server/dist/setup/start-server.js/launchd.js write .env and launchd plist only through setup/start flows with prompts/status handling.
plugins/wechat/dist/ilink-media.js uploads user-supplied media to WeChat/iLink endpoints as channel functionality.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNativeBindingsNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareUrlStrings

Manifest

WildcardDependency

scanned 333 file(s), 8.16 MB of source, external domains: 127.0.0.1, api.anthropic.com, api.openai.com, dashscope.aliyuncs.com, example.com, generativelanguage.googleapis.com, github.com, host.docker.internal, host.openshell.internal, ilinkai.weixin.qq.com, mcp.exa.ai, novac2c.cdn.weixin.qq.com, opencode.ai, raw.githubusercontent.com, react.dev, reactrouter.com, registry.npmjs.org, search.parallel.ai, www.apple.com, www.docker.com, www.w3.org

Source & flagged code

5 flagged

bin/tianshu.mjsView file

Lines 9-33javascript

9// We resolve the dist path *relative to this file* rather than the

10// CWD so the bin works regardless of where the user runs it from

11// (npm install -g lands this in /usr/local/bin or similar; the

12// dist sits a few dirs up).

14import { fileURLToPath } from "node:url";

15import { dirname, resolve } from "node:path";

16import { existsSync } from "node:fs";

18const here = dirname(fileURLToPath(import.meta.url));

19const distEntry = resolve(here, "..", "packages", "server", "dist", "cli.js");

21if (!existsSync(distEntry)) {

22 console.error(

23 `[tianshu] cli build missing: ${distEntry}\n\n` +

24 `If you cloned the repo, run \`npm install && npm run build\` first.\n` +

25 `If you installed via npm and see this, please file a bug — the package is broken.`,

26 );

27 process.exit(1);

28}

30const { main } = await import(distEntry);

31const code = await main(process.argv.slice(2));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/tianshu.mjsView on unpkg · L29

32process.exit(typeof code === "number" ? code : 0);

plugins/wechat/dist/ilink-media.jsView file

Lines 1-38javascript

1// Outbound media (image / video / file) for the iLink bot API.

2//

3// Wire shape mirrors `@tencent-weixin/openclaw-weixin` (MIT) verbatim

4// — that's the reference implementation Tencent ships, and we want to

5// stay protocol-compatible so a future Tencent-side change doesn't

6// force us to diverge.

7//

8// Flow per file:

9// 1. Read + hash plaintext, generate fresh AES-128 key + filekey.

10// 2. POST /ilink/bot/getuploadurl → CDN upload URL (or upload_param

11// to compose one).

packages/server/dist/setup/start-server.jsView file

Lines 1-41javascript

1// Final setup step: pick ports, install + load a launchd agent

2// (macOS) or fall back to a manual command (other platforms),

3// verify /api/health responds.

4//

5// Why launchd rather than a foreground spawn:

6// - it survives terminal close, reboot, crashes (KeepAlive)

7// - it's the documented permanent-install path on macOS (see

8// docs/running.md), so the wizard producing the same plist

9// means there's only one way to run tianshu in dev/prod

10// - cross-platform we still fall back to telling the user the

11// command to run; only macOS gets auto-install

plugins/web-search/dist/tools/web-fetch.jsView file

Lines 1-21javascript

1// `web_fetch(url, extractMode?, maxChars?)`.

2//

3// A plain HTTP GET that extracts readable content and returns it

4// as markdown or text. No JavaScript execution, no API key, no

5// external service — this is the "grab a single page" capability

6// that pairs with web_search. For JS-heavy or login-gated pages

7// the agent should use the browser tool instead.

8//

9// Dependency-free on purpose: the plugin ships without turndown /

10// readability so it stays a tiny self-contained builtin. The

11// extractor below is a pragmatic tag-stripper, not a full DOM

plugins/openshell/dist/runner/openshell-runner.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @tianshu-ai/tianshu@0.4.27 matchedIdentity = npm:QHRpYW5zaHUtYWkvdGlhbnNodQ:0.4.27 similarity = 0.983 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

plugins/openshell/dist/runner/openshell-runner.jsView on unpkg

Source & flagged code

5 flagged · loading source

bin/tianshu.mjsView file

29L30: const { main } = await import(distEntry); L31: const code = await main(process.argv.slice(2));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/tianshu.mjsView on unpkg · L29

plugins/wechat/dist/ilink-media.jsView file

18// L19: // The CDN URL itself is `https://novac2c.cdn.weixin.qq.com/c2c` L20: // (platform constant, matches what Tencent's plugin hard-codes). ... L76: }); L77: const resp = JSON.parse(raw); L78: if (resp.ret && resp.ret !== 0) { ... L92: headers: { "Content-Type": "application/octet-stream" }, L93: body: new Uint8Array(opts.ciphertext), L94: });

Low

Weak Crypto

Package source references weak cryptographic algorithms.

plugins/wechat/dist/ilink-media.jsView on unpkg · L18

packages/server/dist/setup/start-server.jsView file

21import fs from "node:fs"; L22: import net from "node:net"; L23: import os from "node:os"; ... L36: // typically run `tianshu setup` from their home dir, so L37: // process.cwd() won't be the repo. Walk up from this module's L38: // location until we hit a package.json named L39: // '@tianshu-ai/tianshu' (or run out of parents). ... L50: ? path.join(repoRoot, ".env") L51: : path.join(process.env.TIANSHU_HOME ?? L52: path.join(process.env.HOME ?? "", ".tianshu"), ".env")); ... L137: if (!r.ok) { L138: p.log.error(`launchctl kickstart failed: ${r.stderr ?? "(unknown)"}`);

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

packages/server/dist/setup/start-server.jsView on unpkg · L21

plugins/web-search/dist/tools/web-fetch.jsView file

1// `web_fetch(url, extractMode?, maxChars?)`. L2: // ... L14: // L15: // SSRF: we block private / loopback / link-local / metadata hosts L16: // before fetching AND re-check after redirects, so an agent can't ... L93: const ctype = res.headers.get("content-type") ?? ""; L94: const body = await res.text(); L95: let out; ... L110: text, L111: data: { L112: url,

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

plugins/web-search/dist/tools/web-fetch.jsView on unpkg · L1

plugins/openshell/dist/runner/openshell-runner.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

plugins/openshell/dist/runner/openshell-runner.jsView on unpkg

Findings

1 Critical1 High7 Medium7 Low

CriticalPrevious Version Dangerous Deltaplugins/openshell/dist/runner/openshell-runner.js

HighCloud Metadata Accessplugins/web-search/dist/tools/web-fetch.js

MediumDynamic Requirebin/tianshu.mjs

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencepackages/server/dist/setup/start-server.js

MediumProtestware

MediumStructural Risk Force Deep Review

MediumWildcard Dependency

LowNon Install Lifecycle Scripts

LowScripts Present

LowWeak Cryptoplugins/wechat/dist/ilink-media.js

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

5 flagged

bin/tianshu.mjsView file

Lines 9-33javascript

9// We resolve the dist path *relative to this file* rather than the

10// CWD so the bin works regardless of where the user runs it from

11// (npm install -g lands this in /usr/local/bin or similar; the

12// dist sits a few dirs up).

14import { fileURLToPath } from "node:url";

15import { dirname, resolve } from "node:path";

16import { existsSync } from "node:fs";

18const here = dirname(fileURLToPath(import.meta.url));

19const distEntry = resolve(here, "..", "packages", "server", "dist", "cli.js");

21if (!existsSync(distEntry)) {

22 console.error(

23 `[tianshu] cli build missing: ${distEntry}\n\n` +

24 `If you cloned the repo, run \`npm install && npm run build\` first.\n` +

25 `If you installed via npm and see this, please file a bug — the package is broken.`,

26 );

27 process.exit(1);

28}

30const { main } = await import(distEntry);

31const code = await main(process.argv.slice(2));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/tianshu.mjsView on unpkg · L29

32process.exit(typeof code === "number" ? code : 0);

plugins/wechat/dist/ilink-media.jsView file

Lines 1-38javascript

1// Outbound media (image / video / file) for the iLink bot API.

2//

3// Wire shape mirrors `@tencent-weixin/openclaw-weixin` (MIT) verbatim

4// — that's the reference implementation Tencent ships, and we want to

5// stay protocol-compatible so a future Tencent-side change doesn't

6// force us to diverge.

7//

8// Flow per file:

9// 1. Read + hash plaintext, generate fresh AES-128 key + filekey.

10// 2. POST /ilink/bot/getuploadurl → CDN upload URL (or upload_param

11// to compose one).

packages/server/dist/setup/start-server.jsView file

Lines 1-41javascript

1// Final setup step: pick ports, install + load a launchd agent

2// (macOS) or fall back to a manual command (other platforms),

3// verify /api/health responds.

4//

5// Why launchd rather than a foreground spawn:

6// - it survives terminal close, reboot, crashes (KeepAlive)

7// - it's the documented permanent-install path on macOS (see

8// docs/running.md), so the wizard producing the same plist

9// means there's only one way to run tianshu in dev/prod

10// - cross-platform we still fall back to telling the user the

11// command to run; only macOS gets auto-install

plugins/web-search/dist/tools/web-fetch.jsView file

Lines 1-21javascript

1// `web_fetch(url, extractMode?, maxChars?)`.

2//

3// A plain HTTP GET that extracts readable content and returns it

4// as markdown or text. No JavaScript execution, no API key, no

5// external service — this is the "grab a single page" capability

6// that pairs with web_search. For JS-heavy or login-gated pages

7// the agent should use the browser tool instead.

8//

9// Dependency-free on purpose: the plugin ships without turndown /

10// readability so it stays a tiny self-contained builtin. The

11// extractor below is a pragmatic tag-stripper, not a full DOM

plugins/openshell/dist/runner/openshell-runner.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

plugins/openshell/dist/runner/openshell-runner.jsView on unpkg