registry / @whalent/agent / 0.3.515
@whalent/agent@0.3.515
Stable wrapper for Whalent Agent core runtime
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe source confirms a runtime capability to install downloaded files into agent skill directories, while deliberate obfuscation prevents resolving its activation and consent boundaries. The manifest shows no install hook, so the evidence supports a warning rather than a publish block.
Static reason
One or more suspicious static signals were detected.
Trigger
A caller invokes the skill download and install operation.
Impact
Downloaded files may alter the agent’s available skills; no install-time activation or credential theft was established.
Mechanism
The code fetches skill files with a bearer token and writes them under a home, workspace, or managed skill directory.
AI rationale
The source confirms a runtime capability to install downloaded files into agent skill directories, while deliberate obfuscation prevents resolving its activation and consent boundaries. The manifest shows no install hook, so the evidence supports a warning rather than a publish block.
Evidence
dist/mcp.cjsdist/index.cjs
Decision evidence
public snapshotAI called this Suspicious at 72.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The CLI entrypoint and MCP bundle are deliberately obfuscated, limiting verification of their full runtime behavior.
- The MCP code can download skill files using a bearer token and write them into home, workspace, or managed agent skill directories.
- The CLI starts from user-supplied arguments; the manifest shows a prepublishOnly build hook, not an install hook.
Evidence against
- Skill writes are constrained to paths beneath the selected skill directory.
- The inspected manifest does not show a preinstall, install, or postinstall hook.
Behavioral surface
CryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsMinifiedObfuscatedUrlStrings
NoLicense
Source & flagged code
7 flagged · loading sourcedist/mcp.cjsView file
1#!/usr/bin/env node
L2: 'use strict';var a0_0x1f7dac=a0_0x23f3;(function(_0x5b5f24,_0x4a5e21){var _0x52fda3=a0_0x23f3,_0x414589=_0x5b5f24();while(!![]){try{var _0x1441d7=-parseInt(_0x52fda3(0x233f))/0x1+-...
L3: || (${_0x2a255c} == "string" && ${_0x57c727} && ${_0x57c727} == +${_0x57c727})`)[_0x5948dc(0x15d8)](_0x434cc1,(0x0,_0x16815d['_'])`+${_0x57c727}`);return;case'integer':_0x217bc4['e...
High
Obfuscated Payload Loader
Source contains an obfuscated payload loader that reconstructs and executes hidden code.
dist/mcp.cjsView on unpkg · L1•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/mcp.cjsView on unpkg4|| (${_0x2a255c} === "string" && ${_0x57c727} && ${_0x57c727} == +${_0x57c727} && !(${_0x57c727} % 1))`)['assign'](_0x434cc1,(0x0,_0x16815d['_'])`+${_0x57c727}`);return;case'boolea...
L5: || ${_0x2a255c} === "boolean" || ${_0x57c727} === null`)[_0x5948dc(0x15d8)](_0x434cc1,(0x0,_0x16815d['_'])`[${_0x57c727}]`);}}}function _0x2c1a7e({gen:_0x20e59c,parentData:_0x1cc62...
L6: missingProperty: ${_0x386d1c},
Medium
Findings
3 High7 Medium7 Low
HighObfuscated Payload Loaderdist/mcp.cjs
HighObfuscated
HighSemantic Analysis Limiteddist/mcp.cjs
MediumDynamic Requiredist/mcp.cjs
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperdist/jupyter_sidecar.py
MediumOversized Source Filedist/core.cjs
MediumOversized Cli Entrypointdist/core.cjs
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvaldist/mcp.cjs
LowFilesystem
LowHigh Entropy Strings
Low
Affected versions and remediation
This report applies to @whalent/agent@0.3.515.
See all versions of @whalent/agent for other recorded verdicts.
- Review the evidence and your use of @whalent/agent@0.3.515 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.