registry / AI-agent capability abuse / @vectoree/cli
@vectoree/cli
Official Vectoree CLI — login, link, database, storage, Model Gateway, and Tool Hub
This report shows the evidence for @vectoree/cli@0.1.19. 0 of 8 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 1mo ago · by lpm-firewall-aiSource inspection establishes an explicit, guarded agent configuration mutation capability. The flagged execution and network primitives do not establish malicious intent or an automatic installation attack.
Static reason
One or more suspicious static signals were detected.
Trigger
Running vectoree tools snippet --write, optionally with --replace-search.
Impact
Changes the tools available to the agent and stores authentication for the selected MCP destination. No automatic plugin update behavior was identified.
Mechanism
Merges a Vectoree HTTP MCP server into project configuration and optionally removes recognized search servers.
AI rationale
Source inspection establishes an explicit, guarded agent configuration mutation capability. The flagged execution and network primitives do not establish malicious intent or an automatic installation attack.
Evidence
dist/index.jsdist/chunk-EV6ACTMY.js.cursor/mcp.json.vscode/mcp.json.mcp.json
Network endpoints1
vectoree.ai
Decision evidence
public snapshotAI called this Suspicious at 94.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The manifest has no install lifecycle hooks or runtime self-dependency.
- The explicit tools snippet command enables project agent configuration writes only with --write.
- Configuration writes add the Vectoree MCP server; --replace-search optionally deletes matching existing search integrations.
- Writing configuration embeds the available Vectoree API key in the MCP authorization header.
- The MCP destination follows the configurable API origin, which defaults to https://vectoree.ai.
Evidence against
- No covert installation mutation or confirmed malicious execution was identified.
- The flagged child processes read operating-system machine identifiers for the explicit project-link flow, rather than executing a downloaded payload.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
6 flaggeddist/index.jsView file
149// src/device-id.ts
L150: import { execFileSync } from "child_process";
L151: import { randomUUID } from "crypto";
High
136if (!getGlobalFlags().json) {
L137: process.stderr.write(`${message}
L138: `);
...
L143: import { createHash, randomBytes } from "crypto";
L144: import http from "http";
L145: import { URL as URL2 } from "url";
...
L149: // src/device-id.ts
L150: import { execFileSync } from "child_process";
L151: import { randomUUID } from "crypto";
High
Command Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
dist/index.jsView on unpkg · L136136Trigger-reachable command-output exfiltration chain: manifest.bin -> dist/index.js
L136: if (!getGlobalFlags().json) {
L137: process.stderr.write(`${message}
L138: `);
...
L143: import { createHash, randomBytes } from "crypto";
L144: import http from "http";
L145: import { URL as URL2 } from "url";
...
L149: // src/device-id.ts
L150: import { execFileSync } from "child_process";
L151: import { randomUUID } from "crypto";
High
Findings
3 High5 Medium4 Low
HighChild Processdist/index.js
HighCommand Output Exfiltrationdist/index.js
HighTrigger Reachable Command Output Exfiltrationdist/index.js
MediumSecret Patterndist/index.js
MediumNetwork
MediumEnvironment Vars
MediumSuspicious Lifecycle Evidencepackage.json
MediumAi Review Evidencedist/index.js
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @vectoree/cli@0.1.19.
The versions list below shows the verdict for each recorded version.
- Review the evidence and your use of @vectoree/cli@0.1.19 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.