registry / @toolpack-sdk/agents / 2.5.0

@toolpack-sdk/agents@2.5.0

Production AI agents for Toolpack SDK — 8 channel integrations (Slack, Discord, Telegram, SMS, Email, Webhook, Scheduled, MCP), AgentMind persistent cognitive layer (goals, beliefs, reflections), interceptors, evals, and multi-agent coordination

AI Security Review

scanned 3h ago · by lpm-firewall-ai

No confirmed malicious attack surface. Network and process capabilities are documented SDK features activated by consumer configuration and explicit method calls.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Consumer starts configured channels, registry search, scheduler, or HotReloadWatcher.

Impact

No unconsented install-time execution, exfiltration, or foreign control-surface mutation established.

Mechanism

Configured messaging integrations, npm registry search, and opt-in local TypeScript rebuilds.

Rationale

The scanner's claimed command-output exfiltration is not supported by source inspection: the sole child-process path is an explicit hot-reload compile command whose output is handled locally. The package contains expected, consumer-configured agent and channel functionality but no concrete malicious chain.

Evidence

package.jsondist/index.jsdist/index.d.tsdist/channels/index.jsdist/registry/index.jsREADME.md

Network endpoints5

slack.com/api/auth.testslack.com/api/chat.postMessageapi.telegram.orgdiscord.com/api/v10registry.npmjs.org

Decision evidence

public snapshot

AI called this Clean at 96.0% confidence as Benign with low false-positive risk.

Evidence for block

`dist/index.js` exposes an opt-in hot-reload watcher that runs `npx tsc --build` after watched source changes.
`dist/index.js` can call `process.exit(0)` through the explicitly invoked registry restart flow.

Evidence against

`package.json` has no preinstall, install, postinstall, or other lifecycle hook.
`dist/index.js` imports `child_process` only for `HotReloadWatcher`'s documented TypeScript rebuild.
`dist/index.d.ts` requires caller-provided watch paths and restart callback before hot reload activates.
Network calls in `dist/channels/index.js` target configured Slack, Telegram, and Discord integrations.
`dist/registry/index.js` only queries the configurable npm registry search endpoint.
No credential harvesting, shell-output forwarding, eval/vm use, payload download, or stealth persistence was found.

Behavioral surface

Source

ChildProcessCryptoFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 12 file(s), 430 KB of source, external domains: api.telegram.org, discord.com, registry.npmjs.org, slack.com

Source & flagged code

3 flagged

dist/index.jsView file

Lines 1-51javascript

1var $t=Object.defineProperty;var M=(o,e)=>()=>(o&&(e=o(o=0)),e);var ft=(o,e)=>{for(var t in e)$t(o,t,{get:e[t],enumerable:!0})};import zn from"path";import{fileURLToPath as Wn}from"url";var d=M(()=>{"use strict"});function B(o){return o===z}function re(){return z}var z,q=M(()=>{"use strict";d();z=Symbol("interceptor-skip-sentinel")});function se(o,e,t,n,r={}){let s=r.maxInvocationDepth??5;return{async execute(i){let p=(l=>({agent:e,channel:t,registry:n,invocationDepth:l,delegateAndWait:async(m,u)=>{let g=l+1;if(g>s)throw new Y(g,s);if(!n)throw new Error(`Cannot delegate to "${m}": agent is run ...

2`)}function Zt(o){let e=o.progress[o.progress.length-1],t=`[${o.priority}] ${o.description}`;return e&&(t+=` \u2014 last progress: ${e}`),o.dueBy&&(t+=` (due: ${o.dueBy})`),t}function en(

3`);this.delegation.mode==="forget"?a.push({name:"delegate_and_forget",displayName:"Delegate and Forget",description:`Hand off the current task to a peer agent. The agent will handle its own delivery (e.g. posting to Slack or GitHub) \u2014 you do not need to relay its response. Call this ONCE, then output an empty string.

5Available agents:

6${f}`,category:"agent",parameters:{type:"object",properties:{agent:{type:"string",enum:w,description:"Name of the agent to delegate to."},message:{type:"string",description:"The task or message to pass to the agent."}},required:["agent","message"]},execute:async A=>{let x=String(A.agent),D=String(A.message??"");return this._registry.invoke(x,{message:D,conversationId:r,context:{delegatedBy:this.name}}).catch(L=>{console.error(`[${this.name}] delegate_and_forget to ${x} failed:`,L)}),{status:"delegated",agent:x}}}):a.push({name:"delegate_to_agent",displayName:"Delegate to Agent",description:`Ha ...

8Available agents:

9${f}`,category:"agent",parameters:{type:"object",properties:{agent:{type:"string",enum:w,description:"Name of the agent to delegate to."},message:{type:"string",description:"The task or message to pass to the agent."}},required:["agent","message"]},execute:async A=>{let x=String(A.agent),D=String(A.message??"");return this._registry.invoke(x,{message:D,conversationId:r,context:{delegatedBy:this.name}})}})}}if(this.spawn?.enabled&&this.spawn.templates.length>0){let u=n?.spawnDepth??0,g=this.spawn,w=g.maxDepth??3;if(u<w){let f=g.templates,A=f.some(C=>C.name==="self"),x=f.some(C=>C.allowPromptAdd ...

10`),L=A?`Use template name "self" to spawn a replica of the current agent.

11`:"",ne=x?{systemPromptAddition:{type:"string",description:"Optional extra instructions appended to the template's system prompt (only honoured by templates that allow it)."}}:{};a.push({name:"spawn_agent",displayName:"Spawn Agent",description:`Instantiate a temporary helper agent for a focused sub-task. The agent runs once, returns its result, then is discarded.

13Available templates:

14${D}

15`+L+`Spawn depth: ${u}/${w}`,category:"agent",parameters:{type:"object",properties:{template:{type:"string",description:A?'Template name to spawn, or "self" for a self-replica.':"Template name to spawn."},task:{type:"string",description:"The specific task message for the spawned agent."},...ne},required:["template","task"]},execute:async C=>{let b=String(C.template),_=

17${String(C.systemPromptAddition)}`:"";if(b==="self"){let N=typeof this.mode=="string"?{...ue,name:this.mode}:this.mode,J=I.systemPrompt(_);S={...N,name:`${N.name}-replica-${

19${J}`:"")+F},P=`${this.name}-replica`,E=this.description,O=this.model}else S={...ue,name:`ephemeral-${I.name}-${Date.now()}`,systemPrompt:I.systemPrompt(_)+F},P

21Available templates:

22${D}

23`+L+`Spawn depth: ${u}/${w}`,category:"agent",parameters:{type:"object",properties:{tasks:{type:"array",description:"List of agents to spawn in parallel.",items:{type:"object",properties:{template:{type:"string",description:A?'Template name to spawn, or "self" for a self-replica.':"Template name to spawn."},task:{type:"string",description:"The specific task message for this agent."},...x?{systemPromptAddition:{type:"string",description:"Optional extra instructions appended to the template's system prompt (only honoured by templates that allow it)."}}:{}},required:["template","task"]}}},require ...

25${String(P.systemPromptAddition)}`:"",K,U,G,N;if(E==="self"){let V=typeof this.mode=="string"?{...ue,name:this.mode}:this.mode,ht=I.systemPrompt(O);K={...V,name:`${V.

27${ht}`:"")+F},U=`${this.name}-replica`,G=this.description,N=this.model}else K={...ue,name:`ephemeral-${I.name}-${Date.now()}`,systemPrompt:I.systemPrompt(O)+F},U

29Question: "${e}"

30Answer: "${t}"

32Is this answer sufficient? Reply with ONLY "yes" or "no".`,{workflow:{mode:"single-shot"}})).output.toLowerCase().trim().startsWith("yes")}async handlePendingAsk(e,t,n,r){return await this.evaluateAnswer(e.question,t,{simpleValidation:i=>i.trim().length>3})?(await this.resolvePendingAsk(e.id,t),n(t)):e.retries>=e.maxRetries?(await this.resolvePendingAsk(e.id,"__insufficient__"),this._triggeringChannel&&await this.sendTo(this._triggeringChannel,"I was unable to get enough information to proceed. Skipping this step."),r?r():{output:"Step skipped due to insufficient input.",metadata:{skipped:!0,a ...

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

dist/index.jsView on unpkg · L18

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L31

34`).map(t=>`<p>${t.replace(/\n/g,"<br>")}</p>`).join("")}async stop(){this.transporter&&(this.transporter.close(),this.transporter=void 0)}};d();var Ze=class extends R{config;twilioClient;server;constructor(e){super(),

35`)},he=class extends T{name="intent-classifier";description="Classifies whether a message is directly addressing an agent for response";mode=Dn;constructor(e){super(e)}async invokeAgent(e){let t=e.data;if(t?.isDirectMessage)return{output:"direct",metadata:{classification:"direct",shortCircuit:"dm"}};if(!t?.message)

36Recent conversation:`);for(let c of t.recentContext)n.push(` ${c.sender}: ${c.content.substring(0,100)}`)}n.push(`

37Message to classify: "${t.message}"`),t.includeExamples&&(n.push(`

38Examples of classifications:`),n.push(` "@${t.agentName} help me" \u2192 direct`),n.push(` "Can someone ask ${t.agentName} about this?" \u2192 indirect`),n.push(` "I was talking to ${t.agentName} earlier" \u2192 passive`),n.push(' "Check the logs" \u2192 ignore')),n.push(`

39Classification (start with direct, indirect, passive, or ignore):`);let r=n.join(`

40`),s=await this.run(r),i=this.normalizeClassification(s.output);return{output:i,metadata:{rawOutput:s.output,classification:i,confidence:"high"}}}normalizeClassification(e){let t=e.toLowerCase().trim().split(/\s+/)[0],n=e.toLowerCase();return["direct","indirect","passive","ignore"].includes(t)?t:n.includes("indirect")||n.includes("mention")?"indirect":n.includes("passive")||n.includes("listen")?"passive":n.includes("ignore")||n.includes("skip")?"ignore":n.includes("direct")||n.includes("addressed")?"direct":"ignore"}};d();j();import{CHAT_MODE as On}from"toolpack-sdk";var Nn={...On,name:"summar ...

41`)},fe=class extends T{name="summarizer";description="Compresses conversation history into compact summaries for prompt assembly";mode=Nn;constructor(e){super(e)}async invokeAgent(e){let t=e.data;if(!t?.turns||t.turns.length===0)return{output:JSON.

42`),c=await this.run(i),p=this.parseSummarizerOutput(c.output,t.turns.length);return{output:JSON.stringify(p),metadata:{turnsProcessed:t.turns.length,rawOutputLength:c.output.length}}}parseSummarizerOutput(e,t){let n=e.trim(),r=n.match(/```(?:json)?\s*([\s\S]*?)\s*```/);r&&(n=r[

43`)}}}Le();d();q();Se();d();d();var tt=class{constructor(e){this.maxSize=e}maxSize;cache=new Map;has(e){return this.cache.has(e)}set(e,t){if(this.cache.has(e)&&this.cache.delete(e),this.cache.size>=this.maxSize){let n=this.cache.keys().next().value;n!==void 0&&this.cache.delete(n)}this.cache.set(e,t)}clear(){this.cache.clear()}size(){return this.cache.size}};function nt(o={}){let e=o.maxCacheSize??1e3,t=o.getEventId??(r=>r.context?.eventId),n=new tt(e);return async(r,s,i)=>{let c=t(r);if(c){if(n.has(c))return o.onDuplicate?.(c,r),s.logger?.debug(`Event dedup: dropping duplicate event ${c}`,{eve ...

44 CREATE TABLE IF NOT EXISTS scheduled_jobs (

45 id TEXT PRIMARY KEY,

46 channel_name TEXT,

47 next_run_at INTEGER NOT NULL,

48 cron TEXT,

49 intent TEXT,

50 message TEXT,

51 payload TEXT,

Long lines were clipped for display.

dist/index.cjsView file

Lines 1-38javascript

1"use strict";var tn=Object.create;var Ie=Object.defineProperty;var nn=Object.getOwnPropertyDescriptor;var rn=Object.getOwnPropertyNames;var sn=Object.getPrototypeOf,on=Object.prototype.hasOwnProperty;var P=(o,e)=>()=>(o&&

Source & flagged code

3 flagged · loading source

dist/index.jsView file

18L19: ${J}`:"")+F},P=`${this.name}-replica`,E=this.description,O=this.model}else S={...ue,name:`ephemeral-${I.name}-${Date.now()}`,systemPrompt:I.systemPrompt(_)+F},P=I.name,E=I.descript... L20: ... L31: L32: Is this answer sufficient? Reply with ONLY "yes" or "no".`,{workflow:{mode:"single-shot"}})).output.toLowerCase().trim().startsWith("yes")}async handlePendingAsk(e,t,n,r){return aw... L33:

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

dist/index.jsView on unpkg · L18

31L32: Is this answer sufficient? Reply with ONLY "yes" or "no".`,{workflow:{mode:"single-shot"}})).output.toLowerCase().trim().startsWith("yes")}async handlePendingAsk(e,t,n,r){return aw... L33:

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L31

dist/index.cjsView file

18Trigger-reachable chain: manifest.main -> dist/index.cjs L18: L19: ${H}`:"")+U},E=`${this.name}-replica`,_=this.description,D=this.model}else S={...L.AGENT_MODE,name:`ephemeral-${b.name}-${Date.now()}`,systemPrompt:b.systemPrompt(T)+U},E=b.name,_=... L20: ... L31: L32: Is this answer sufficient? Reply with ONLY "yes" or "no".`,{workflow:{mode:"single-shot"}})).output.toLowerCase().trim().startsWith("yes")}async handlePendingAsk(e,t,n,r){return aw... L33:

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.cjsView on unpkg · L18

Findings

2 Critical1 High2 Medium4 Low

CriticalCommand Output Exfiltrationdist/index.js

CriticalTrigger Reachable Dangerous Capabilitydist/index.cjs

HighChild Processdist/index.js

MediumNetwork

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

dist/index.jsView file

Lines 1-51javascript

2`)}function Zt(o){let e=o.progress[o.progress.length-1],t=`[${o.priority}] ${o.description}`;return e&&(t+=` \u2014 last progress: ${e}`),o.dueBy&&(t+=` (due: ${o.dueBy})`),t}function en(

5Available agents:

8Available agents:

10`),L=A?`Use template name "self" to spawn a replica of the current agent.

13Available templates:

14${D}

17${String(C.systemPromptAddition)}`:"";if(b==="self"){let N=typeof this.mode=="string"?{...ue,name:this.mode}:this.mode,J=I.systemPrompt(_);S={...N,name:`${N.name}-replica-${

19${J}`:"")+F},P=`${this.name}-replica`,E=this.description,O=this.model}else S={...ue,name:`ephemeral-${I.name}-${Date.now()}`,systemPrompt:I.systemPrompt(_)+F},P

21Available templates:

22${D}

25${String(P.systemPromptAddition)}`:"",K,U,G,N;if(E==="self"){let V=typeof this.mode=="string"?{...ue,name:this.mode}:this.mode,ht=I.systemPrompt(O);K={...V,name:`${V.

27${ht}`:"")+F},U=`${this.name}-replica`,G=this.description,N=this.model}else K={...ue,name:`ephemeral-${I.name}-${Date.now()}`,systemPrompt:I.systemPrompt(O)+F},U

29Question: "${e}"

30Answer: "${t}"

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

dist/index.jsView on unpkg · L18

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L31

36Recent conversation:`);for(let c of t.recentContext)n.push(` ${c.sender}: ${c.content.substring(0,100)}`)}n.push(`

37Message to classify: "${t.message}"`),t.includeExamples&&(n.push(`

39Classification (start with direct, indirect, passive, or ignore):`);let r=n.join(`

44 CREATE TABLE IF NOT EXISTS scheduled_jobs (

45 id TEXT PRIMARY KEY,

46 channel_name TEXT,

47 next_run_at INTEGER NOT NULL,

48 cron TEXT,

49 intent TEXT,

50 message TEXT,

51 payload TEXT,

Long lines were clipped for display.

dist/index.cjsView file

Lines 1-38javascript