@whalent/agent@0.3.480
Stable wrapper for Whalent Agent core runtime
AI Security Review
scanned 22d ago · by lpm-firewall-aiThe inspected code exposes requested agent configuration mutation, which falls under the warning policy rather than an install-time blocking rule. The core caller was inspected, but its citation could not be issued because the file exceeds the tool's 16 MiB verification limit.
Static reason
One or more suspicious static signals were detected.
Trigger
An explicit agent tool operation requesting skill installation or MCP server registration.
Impact
Requested changes can alter the tools and instructions available to an AI agent.
Mechanism
The tool handler passes supplied server settings to platform configuration writers; skill helpers write files into the selected agent scope.
AI rationale
The inspected code exposes requested agent configuration mutation, which falls under the warning policy rather than an install-time blocking rule. The core caller was inspected, but its citation could not be issued because the file exceeds the tool's 16 MiB verification limit.
Evidence
dist/mcp.cjsdist/core.cjs.claude.jsonconfig.toml
Decision evidence
public snapshotAI called this Suspicious at 83.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Agent integration code resolves machine-scoped skills under the user's agent platform directory.
- Agent configuration helpers write MCP server commands, arguments and environment settings into .claude.json.
- dist/core.cjs routes an explicit tool operation to injectMcpServer and returns the registered server name; this exposes agent configuration mutation through a requested operation.
Evidence against
- package.json has no preinstall, install or postinstall hook and no runtime self-dependency.
- Inspected behavior supports a requested agent integration capability, without concrete evidence of covert installation, credential theft or malicious intent.
Behavioral surface
CryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsMinifiedObfuscatedUrlStrings
Source & flagged code
8 flagged · loading sourcedist/mcp.cjsView file
4|| (${_0x3640aa} === "string" && ${_0x34f24a} && ${_0x34f24a} == +${_0x34f24a} && !(${_0x34f24a} % 1))`)[_0x59cd6b(0x1c3c)](_0x187816,(0x0,_0x279ede['_'])`+${_0x34f24a}`);return;ca...
L5: || ${_0x3640aa} === "boolean" || ${_0x34f24a} === null`)['assign'](_0x187816,(0x0,_0x279ede['_'])`[${_0x34f24a}]`);}}}function _0x5adb46({gen:_0x256eaa,parentData:_0x38556c,parentD...
L6: missingProperty: ${_0x25e244},
L7: depsCount: ${_0x41455e},
L8: deps: ${_0x476e8b}}`};var _0x3af1d3={'keyword':_0x3de18d(0x384),'type':_0x3de18d(0x914),'schemaType':_0x3de18d(0x914),'error':_0x418fe0['error'],'code'(_0x1142c0){const [_0x1f6161,...
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/mcp.cjsView on unpkg · L41#!/usr/bin/env node
L2: 'use strict';var a0_0x41b1be=a0_0xc1bb;(function(_0x103d89,_0x909201){var _0x20974f=a0_0xc1bb,_0x8b55=_0x103d89();while(!![]){try{var _0x5efab5=-parseInt(_0x20974f(0xeb5))/0x1+-par...
L3: || (${_0x3640aa} == "string" && ${_0x34f24a} && ${_0x34f24a} == +${_0x34f24a})`)[_0x59cd6b(0x1c3c)](_0x187816,(0x0,_0x279ede['_'])`+${_0x34f24a}`);return;case _0x59cd6b(0x801):_0x5...
High
Obfuscated Payload Loader
Source contains an obfuscated payload loader that reconstructs and executes hidden code.
dist/mcp.cjsView on unpkg · L1•
Findings
4 High7 Medium7 Low
HighSame File Env Network Executiondist/mcp.cjs
HighObfuscated Payload Loaderdist/mcp.cjs
HighObfuscated
HighSemantic Analysis Limiteddist/mcp.cjs
MediumDynamic Requiredist/mcp.cjs
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperdist/jupyter_sidecar.py
MediumOversized Source Filedist/core.cjs
MediumOversized Cli Entrypointdist/core.cjs
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvaldist/mcp.cjs
LowFilesystem
Affected versions and remediation
This report applies to @whalent/agent@0.3.480.
See all versions of @whalent/agent for other recorded verdicts.
- Review the evidence and your use of @whalent/agent@0.3.480 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.