registry / @tianshu-ai/tianshu / 0.4.30

@tianshu-ai/tianshu@0.4.30

An open AI agent platform with a sidecar browser. Built in public.

AI Security Review

scanned 4d ago · by lpm-firewall-ai

No confirmed malicious attack surface was found. Network, shell, file, and launchd behavior are aligned with an AI agent platform, web search, sandbox runner, setup command, and WeChat integration, and are user/runtime invoked rather than install-time hidden execution.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

explicit CLI/plugin/runtime use

Impact

no confirmed credential theft, exfiltration, persistence abuse, or install-time execution

Mechanism

package-aligned agent platform capabilities

Rationale

Static inspection found powerful but expected functionality for this package: CLI service setup, sandboxed agent execution, web fetch/search, and WeChat media upload. The scanner-reported metadata endpoint string is part of an SSRF blocklist, and persistence/file/network operations are explicit user or plugin workflows, not covert lifecycle behavior.

Evidence

package.jsonbin/tianshu.mjsplugins/web-search/dist/tools/web-fetch.jsplugins/web-search/dist/tools/providers.jsplugins/workboard/dist/worker/opencode-worker.jspackages/server/dist/setup/start-server.jspackages/server/dist/setup/launchd.jsplugins/wechat/dist/ilink-api.jsplugins/wechat/dist/ilink-media.js.env~/Library/LaunchAgents/ai.tianshu.*.plist~/Library/Logs/tianshu/*.logopencode/<taskId>/opencode.jsonopencode/<taskId>/.prompt.txtopencode/<taskId>/opencode-transcript.jsonl

Network endpoints4

search.parallel.ai/mcpmcp.exa.ai/mcpilinkai.weixin.qq.comnovac2c.cdn.weixin.qq.com/c2c

Decision evidence

public snapshot

AI called this Clean at 84.0% confidence as Benign with low false-positive risk.

Evidence for block

Evidence against

package.json has no install/postinstall hooks; prepublishOnly is publish-time build only.
bin/tianshu.mjs only resolves packages/server/dist/cli.js relative to the package and imports main().
plugins/web-search/dist/tools/web-fetch.js implements user-requested HTTP fetch and blocks localhost, private ranges, link-local, and metadata hosts before redirects.
plugins/workboard/dist/worker/opencode-worker.js runs opencode only for a workboard task inside the configured shell sandbox with a per-task proxy token that is revoked in finally.
packages/server/dist/setup/start-server.js and setup/launchd.js write .env/plist only during explicit setup/start flows with prompts or service commands.
plugins/wechat/dist/ilink-media.js reads a caller-supplied file path and uploads encrypted media to Tencent iLink/CDN as part of the WeChat plugin workflow.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNativeBindingsNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareUrlStrings

Manifest

WildcardDependency

scanned 333 file(s), 8.16 MB of source, external domains: 127.0.0.1, api.anthropic.com, api.openai.com, dashscope.aliyuncs.com, example.com, generativelanguage.googleapis.com, github.com, host.docker.internal, host.openshell.internal, ilinkai.weixin.qq.com, mcp.exa.ai, novac2c.cdn.weixin.qq.com, opencode.ai, raw.githubusercontent.com, react.dev, reactrouter.com, registry.npmjs.org, search.parallel.ai, www.apple.com, www.docker.com, www.w3.org

Source & flagged code

5 flagged

bin/tianshu.mjsView file

Lines 9-33javascript

9// We resolve the dist path *relative to this file* rather than the

10// CWD so the bin works regardless of where the user runs it from

11// (npm install -g lands this in /usr/local/bin or similar; the

12// dist sits a few dirs up).

14import { fileURLToPath } from "node:url";

15import { dirname, resolve } from "node:path";

16import { existsSync } from "node:fs";

18const here = dirname(fileURLToPath(import.meta.url));

19const distEntry = resolve(here, "..", "packages", "server", "dist", "cli.js");

21if (!existsSync(distEntry)) {

22 console.error(

23 `[tianshu] cli build missing: ${distEntry}\n\n` +

24 `If you cloned the repo, run \`npm install && npm run build\` first.\n` +

25 `If you installed via npm and see this, please file a bug — the package is broken.`,

26 );

27 process.exit(1);

28}

30const { main } = await import(distEntry);

31const code = await main(process.argv.slice(2));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/tianshu.mjsView on unpkg · L29

32process.exit(typeof code === "number" ? code : 0);

plugins/wechat/dist/ilink-media.jsView file

Lines 1-38javascript

1// Outbound media (image / video / file) for the iLink bot API.

2//

3// Wire shape mirrors `@tencent-weixin/openclaw-weixin` (MIT) verbatim

4// — that's the reference implementation Tencent ships, and we want to

5// stay protocol-compatible so a future Tencent-side change doesn't

6// force us to diverge.

7//

8// Flow per file:

9// 1. Read + hash plaintext, generate fresh AES-128 key + filekey.

10// 2. POST /ilink/bot/getuploadurl → CDN upload URL (or upload_param

11// to compose one).

packages/server/dist/setup/start-server.jsView file

Lines 1-41javascript

1// Final setup step: pick ports, install + load a launchd agent

2// (macOS) or fall back to a manual command (other platforms),

3// verify /api/health responds.

4//

5// Why launchd rather than a foreground spawn:

6// - it survives terminal close, reboot, crashes (KeepAlive)

7// - it's the documented permanent-install path on macOS (see

8// docs/running.md), so the wizard producing the same plist

9// means there's only one way to run tianshu in dev/prod

10// - cross-platform we still fall back to telling the user the

11// command to run; only macOS gets auto-install

plugins/web-search/dist/tools/web-fetch.jsView file

Lines 1-21javascript

1// `web_fetch(url, extractMode?, maxChars?)`.

2//

3// A plain HTTP GET that extracts readable content and returns it

4// as markdown or text. No JavaScript execution, no API key, no

5// external service — this is the "grab a single page" capability

6// that pairs with web_search. For JS-heavy or login-gated pages

7// the agent should use the browser tool instead.

8//

9// Dependency-free on purpose: the plugin ships without turndown /

10// readability so it stays a tiny self-contained builtin. The

11// extractor below is a pragmatic tag-stripper, not a full DOM

plugins/workboard/dist/worker/opencode-worker.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @tianshu-ai/tianshu@0.4.28 matchedIdentity = npm:QHRpYW5zaHUtYWkvdGlhbnNodQ:0.4.28 similarity = 0.992 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

plugins/workboard/dist/worker/opencode-worker.jsView on unpkg

Source & flagged code

5 flagged · loading source

bin/tianshu.mjsView file

29L30: const { main } = await import(distEntry); L31: const code = await main(process.argv.slice(2));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/tianshu.mjsView on unpkg · L29

plugins/wechat/dist/ilink-media.jsView file

18// L19: // The CDN URL itself is `https://novac2c.cdn.weixin.qq.com/c2c` L20: // (platform constant, matches what Tencent's plugin hard-codes). ... L76: }); L77: const resp = JSON.parse(raw); L78: if (resp.ret && resp.ret !== 0) { ... L92: headers: { "Content-Type": "application/octet-stream" }, L93: body: new Uint8Array(opts.ciphertext), L94: });

Low

Weak Crypto

Package source references weak cryptographic algorithms.

plugins/wechat/dist/ilink-media.jsView on unpkg · L18

packages/server/dist/setup/start-server.jsView file

21import fs from "node:fs"; L22: import net from "node:net"; L23: import os from "node:os"; ... L36: // typically run `tianshu setup` from their home dir, so L37: // process.cwd() won't be the repo. Walk up from this module's L38: // location until we hit a package.json named L39: // '@tianshu-ai/tianshu' (or run out of parents). ... L50: ? path.join(repoRoot, ".env") L51: : path.join(process.env.TIANSHU_HOME ?? L52: path.join(process.env.HOME ?? "", ".tianshu"), ".env")); ... L137: if (!r.ok) { L138: p.log.error(`launchctl kickstart failed: ${r.stderr ?? "(unknown)"}`);

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

packages/server/dist/setup/start-server.jsView on unpkg · L21

plugins/web-search/dist/tools/web-fetch.jsView file

1// `web_fetch(url, extractMode?, maxChars?)`. L2: // ... L14: // L15: // SSRF: we block private / loopback / link-local / metadata hosts L16: // before fetching AND re-check after redirects, so an agent can't ... L93: const ctype = res.headers.get("content-type") ?? ""; L94: const body = await res.text(); L95: let out; ... L110: text, L111: data: { L112: url,

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

plugins/web-search/dist/tools/web-fetch.jsView on unpkg · L1

plugins/workboard/dist/worker/opencode-worker.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

plugins/workboard/dist/worker/opencode-worker.jsView on unpkg

Findings

1 Critical1 High7 Medium7 Low

CriticalPrevious Version Dangerous Deltaplugins/workboard/dist/worker/opencode-worker.js

HighCloud Metadata Accessplugins/web-search/dist/tools/web-fetch.js

MediumDynamic Requirebin/tianshu.mjs

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencepackages/server/dist/setup/start-server.js

MediumProtestware

MediumStructural Risk Force Deep Review

MediumWildcard Dependency

LowNon Install Lifecycle Scripts

LowScripts Present

LowWeak Cryptoplugins/wechat/dist/ilink-media.js

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

5 flagged

bin/tianshu.mjsView file

Lines 9-33javascript

9// We resolve the dist path *relative to this file* rather than the

10// CWD so the bin works regardless of where the user runs it from

11// (npm install -g lands this in /usr/local/bin or similar; the

12// dist sits a few dirs up).

14import { fileURLToPath } from "node:url";

15import { dirname, resolve } from "node:path";

16import { existsSync } from "node:fs";

18const here = dirname(fileURLToPath(import.meta.url));

19const distEntry = resolve(here, "..", "packages", "server", "dist", "cli.js");

21if (!existsSync(distEntry)) {

22 console.error(

23 `[tianshu] cli build missing: ${distEntry}\n\n` +

24 `If you cloned the repo, run \`npm install && npm run build\` first.\n` +

25 `If you installed via npm and see this, please file a bug — the package is broken.`,

26 );

27 process.exit(1);

28}

30const { main } = await import(distEntry);

31const code = await main(process.argv.slice(2));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/tianshu.mjsView on unpkg · L29

32process.exit(typeof code === "number" ? code : 0);

plugins/wechat/dist/ilink-media.jsView file

Lines 1-38javascript

1// Outbound media (image / video / file) for the iLink bot API.

2//

3// Wire shape mirrors `@tencent-weixin/openclaw-weixin` (MIT) verbatim

4// — that's the reference implementation Tencent ships, and we want to

5// stay protocol-compatible so a future Tencent-side change doesn't

6// force us to diverge.

7//

8// Flow per file:

9// 1. Read + hash plaintext, generate fresh AES-128 key + filekey.

10// 2. POST /ilink/bot/getuploadurl → CDN upload URL (or upload_param

11// to compose one).

packages/server/dist/setup/start-server.jsView file

Lines 1-41javascript

1// Final setup step: pick ports, install + load a launchd agent

2// (macOS) or fall back to a manual command (other platforms),

3// verify /api/health responds.

4//

5// Why launchd rather than a foreground spawn:

6// - it survives terminal close, reboot, crashes (KeepAlive)

7// - it's the documented permanent-install path on macOS (see

8// docs/running.md), so the wizard producing the same plist

9// means there's only one way to run tianshu in dev/prod

10// - cross-platform we still fall back to telling the user the

11// command to run; only macOS gets auto-install

plugins/web-search/dist/tools/web-fetch.jsView file

Lines 1-21javascript

1// `web_fetch(url, extractMode?, maxChars?)`.

2//

3// A plain HTTP GET that extracts readable content and returns it

4// as markdown or text. No JavaScript execution, no API key, no

5// external service — this is the "grab a single page" capability

6// that pairs with web_search. For JS-heavy or login-gated pages

7// the agent should use the browser tool instead.

8//

9// Dependency-free on purpose: the plugin ships without turndown /

10// readability so it stays a tiny self-contained builtin. The

11// extractor below is a pragmatic tag-stripper, not a full DOM

plugins/workboard/dist/worker/opencode-worker.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

plugins/workboard/dist/worker/opencode-worker.jsView on unpkg