agency-lang@0.15.0
The Agency language
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThis is not malicious behavior: the relevant mutations are explicit, named CLI features and no install hook exists. Per firewall policy, explicit user-command mutation of an AI-agent control surface warrants a warning.
Static reason
No blocking static signals were detected.
Trigger
User runs `agency mcp setup codex` or `agency schedule add`.
Impact
Can modify Codex MCP configuration or register a launchd job for a user-selected agent.
Mechanism
User-invoked agent configuration and scheduled-agent setup.
AI rationale
This is not malicious behavior: the relevant mutations are explicit, named CLI features and no install hook exists. Per firewall policy, explicit user-command mutation of an AI-agent control surface warrants a warning.
Evidence
package.jsondist/scripts/agency.jsdist/lib/mcp/setup.jsdist/lib/cli/schedule/index.jsdist/lib/cli/schedule/backends/launchd.jsdist/lib/stdlib/oauth.js~/.codex/config.toml~/Library/LaunchAgents/com.agency.schedule.<name>.plist
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Explicit `mcp setup codex` configures Codex with this package's MCP server.
- The setup routine writes an MCP section to the user's Codex config.
- Explicit `schedule add` can install and load a launchd agent.
Evidence against
- package.json has no preinstall, install, or postinstall lifecycle hook.
- Configuration and persistence changes are reachable only through named CLI commands.
- No reviewed source showed credential harvesting, stealth exfiltration, remote payload loading, or destructive behavior.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsTelemetryUrlStrings
Source & flagged code
5 flaggeddist/lib/optimize/workspace.jsView file
6/** Mint a fresh cache-partition token. */
L7: fork() {
L8: this.counter += 1;
High
Child Process
Package source references child process execution.
dist/lib/optimize/workspace.jsView on unpkg · L6dist/lib/runtime/ipc.jsView file
379env: { ...process.env, AGENCY_IPC: "1" },
L380: execArgv: [`--max-old-space-size=${memoryMb}`],
L381: ...(args.cwd ? { cwd: args.cwd } : {}),
High
dist/scripts/agency.jsView file
480.action(async (file, opts) => {
L481: const result = await runSecretsImport(file, opts, getConfigContext(), {
L482: stdinIsTty: process.stdin.isTTY === true,
Findings
3 High4 Medium5 Low
HighChild Processdist/lib/optimize/workspace.js
HighShelldist/lib/runtime/ipc.js
HighSame File Env Network Executiondist/lib/stdlib/oauth.js
MediumDynamic Requiredist/scripts/agency.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/lib/cli/schedule/backends/launchd.js
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to agency-lang@0.15.0.
See all versions of agency-lang for other recorded verdicts.
- Review the evidence and your use of agency-lang@0.15.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.