@whalent/agent-core@0.3.470
Core runtime for Whalent Agent
AI Security Review
scanned 26d ago · by lpm-firewall-aiThe bundle can rewrite foreign agent MCP configs and skill directories, but only through an explicit daemon tool action, and package.json has no install hook. That is a guarded agent-control capability, so it warrants a warning rather than a publish block.
Static reason
One or more suspicious static signals were detected.
Trigger
An explicit daemon tool call with action register, or the skill install action, while dist/mcp.cjs is running.
Impact
A caller of the daemon can add or replace MCP server entries and skill files for other local AI agents. There is no install-time or silent startup mutation.
Mechanism
injectMcpServer selects Claude, OpenCode, Kimi, or Codex and writes the supplied command into that product's MCP config. installSkill resolves a platform skill directory and writes the provided files.
AI rationale
The bundle can rewrite foreign agent MCP configs and skill directories, but only through an explicit daemon tool action, and package.json has no install hook. That is a guarded agent-control capability, so it warrants a warning rather than a publish block.
Evidence
dist/mcp.cjspackage.json.claude.json.claude.cursor.agentsmcp.jsonconfig.toml
Decision evidence
public snapshotAI called this Suspicious at 74.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- A daemon tool action named register calls injectMcpServer with the caller-supplied server name, command, args, and env.
- injectMcpServer writes that server into Claude, OpenCode, Kimi, or Codex config, including ~/.claude.json via writeClaudeConfig.
- installSkill creates a directory from platformDir (.claude, .cursor, or .agents) under the home directory or workspace and writes skill files there.
- package.json exposes the whalent-core CLI and has no install lifecycle scripts, so these writes run only when the daemon tool is invoked.
Evidence against
- Published package.json has no preinstall, install, or postinstall hook.
- Skill file writes reject absolute paths and paths that escape the skill directory.
- The platform token is a caller-supplied Whalent token sent to the configured Whalent platform, defaulting to memory.whalent.com.
Behavioral surface
CryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork
Source & flagged code
8 flagged · loading sourcedist/mcp.cjsView file
4|| (${_0x5774e2} === "string" && ${_0x520dc5} && ${_0x520dc5} == +${_0x520dc5} && !(${_0x520dc5} % 1))`)[_0x14c971(0x278)](_0x303abc,(0x0,_0x1f6a24['_'])`+${_0x520dc5}`);return;cas...
L5: || ${_0x5774e2} === "boolean" || ${_0x520dc5} === null`)['assign'](_0x303abc,(0x0,_0x1f6a24['_'])`[${_0x520dc5}]`);}}}function _0x730ac9({gen:_0x5e9b26,parentData:_0x3ea42c,parentD...
L6: missingProperty: ${_0x53f885},
L7: depsCount: ${_0x2c0756},
L8: deps: ${_0x4d7923}}`};var _0x4f6b3d={'keyword':'dependencies','type':_0x514d9a(0x5c6),'schemaType':_0x514d9a(0x5c6),'error':_0x7bbad7['error'],'code'(_0x398850){const [_0x505630,_0...
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/mcp.cjsView on unpkg · L41#!/usr/bin/env node
L2: 'use strict';var a0_0xb5f14=a0_0x212d;(function(_0x17e453,_0xc163b6){var _0x190078=a0_0x212d,_0x31607b=_0x17e453();while(!![]){try{var _0x1a895d=parseInt(_0x190078(0x11d1))/0x1+-pa...
L3: || (${_0x5774e2} == "string" && ${_0x520dc5} && ${_0x520dc5} == +${_0x520dc5})`)[_0x14c971(0x278)](_0x303abc,(0x0,_0x1f6a24['_'])`+${_0x520dc5}`);return;case'integer':_0x5a31f0['el...
High
Obfuscated Payload Loader
Source contains an obfuscated payload loader that reconstructs and executes hidden code.
dist/mcp.cjsView on unpkg · L1Findings
4 High7 Medium5 Low
HighSame File Env Network Executiondist/mcp.cjs
HighObfuscated Payload Loaderdist/mcp.cjs
HighObfuscated
HighSemantic Analysis Limiteddist/mcp.cjs
MediumDynamic Requiredist/mcp.cjs
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperdist/jupyter_sidecar.py
MediumOversized Source Filedist/index.cjs
MediumOversized Cli Entrypointdist/index.cjs
MediumStructural Risk Force Deep Review
LowEvaldist/mcp.cjs
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @whalent/agent-core@0.3.470.
See all versions of @whalent/agent-core for other recorded verdicts.
- Review the evidence and your use of @whalent/agent-core@0.3.470 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.