aclade-agent@1.3.0
Aclade Local AI Agent Connector
AI Security Review
scanned 1mo ago · by lpm-firewall-aiInspected source shows unrestricted forwarding of an existing service token when the operator changes the host. The remaining execution and installation primitives fit the running agent's functionality, with no concrete malicious chain established.
Static reason
One or more suspicious static signals were detected.
Trigger
Run the agent with --host pointing to another destination while retaining a saved or environment-provided token.
Impact
The selected endpoint can receive the existing service credential; an HTTP destination also exposes it in transit.
Mechanism
Host selection and token fallback are independent; the polling client sends Bearer authentication without a destination allowlist.
AI rationale
Inspected source shows unrestricted forwarding of an existing service token when the operator changes the host. The remaining execution and installation primitives fit the running agent's functionality, with no concrete malicious chain established.
Evidence
src/index.tsdist/index.js.aclade-agent.json
Network endpoints1
aclade.com
Decision evidence
public snapshotAI called this Suspicious at 94.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- package.json has no installation lifecycle hooks or runtime self-dependency.
- src/index.ts reads the saved agent configuration, including its token.
- dist/index.js accepts an unrestricted --host and retains the existing token when no replacement is supplied.
- The polling request sends that token as Bearer authentication to the selected host through HTTP or HTTPS.
- The active entrypoint starts polling whenever a token is available.
Evidence against
- The default destination is https://aclade.com; changing it requires operator configuration.
- Shell execution, browser automation, scheduled commands, and npm self-updates follow the agent's task-processing structure.
- No hidden unrelated recipient or concrete malicious installation behavior was identified.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStrings
Source & flagged code
4 flaggeddist/index.jsView file
38const https = __importStar(require("https"));
L39: const child_process = __importStar(require("child_process"));
L40: const fs = __importStar(require("fs"));
High
60* The agent already self-updates through npm, so telling a customer to run
L61: * `npx playwright install` by hand was busywork we could just do. playwright-core
L62: * ships the same installer the `playwright` package exposes, so we invoke it
...
L73: console.log("=> Preparing the browser (one-time download, ~50MB)…");
L74: const proc = child_process.spawn(process.execPath, [cli, "install", "chromium", "--only-shell", "--no-progress"], {
L75: stdio: ["ignore", "pipe", "pipe"],
High
Runtime Package Install
Package source invokes a package manager install command at runtime.
dist/index.jsView on unpkg · L60src/index.tsView file
532const proc = child_process.spawn(input.command, [], { // nosemgrep: javascript.lang.security.detect-child-process.detect-child-process
L533: shell: true,
L534: cwd: input.cwd ? resolvePath(input.cwd) : workspaceRoot,
Findings
3 High4 Medium5 Low
HighChild Processdist/index.js
HighShellsrc/index.ts
HighRuntime Package Installdist/index.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumSuspicious Lifecycle Evidencepackage.json
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to aclade-agent@1.3.0.
See all versions of aclade-agent for other recorded verdicts.
- Review the evidence and your use of aclade-agent@1.3.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.