registry / agency-lang / 0.20.0
agency-lang@0.20.0
The Agency language
AI Security Review
scanned 24d ago · by lpm-firewall-aiThe inspected source supports package functionality and guarded file updates; the scanner's execution and network indicators alone do not establish malicious behavior. No install hook or concrete attack behavior was identified.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Use of the package runtime, CLI, or OAuth functionality.
Impact
No harmful effect was established from these inspected behaviors.
Mechanism
The inspected code launches Node or a bounded runtime subprocess, performs OAuth token exchange, and checks source hashes before writeback.
AI rationale
The inspected source supports package functionality and guarded file updates; the scanner's execution and network indicators alone do not establish malicious behavior. No install hook or concrete attack behavior was identified.
Decision evidence
public snapshotAI called this Clean at 86.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json lists ordinary test and CLI scripts; no install hook is shown in the scripts section.
- dist/lib/optimize/workspace.js checks source file hashes before writeback and aborts if a file changed.
- dist/lib/runtime/ipc.js forks a subprocess using configured limits and working directory.
- dist/lib/stdlib/oauth.js exchanges authorization data through an HTTP helper as part of OAuth token handling.
- dist/lib/cli/commands.js starts Node with compiled output and runtime arguments.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsTelemetryUrlStrings
Source & flagged code
8 flaggeddist/lib/optimize/workspace.jsView file
6/** Mint a fresh cache-partition token. */
L7: fork() {
L8: this.counter += 1;
High
Child Process
Package source references child process execution.
dist/lib/optimize/workspace.jsView on unpkg · L6dist/lib/runtime/ipc.jsView file
388env: { ...process.env, AGENCY_IPC: "1" },
L389: execArgv: [`--max-old-space-size=${memoryMb}`],
L390: ...(args.cwd ? { cwd: args.cwd } : {}),
High
dist/lib/optimize/optimizerModule.jsView file
32// eslint-disable-next-line no-restricted-syntax -- CLI-layer loading of a user artifact; the bundle path is only known at runtime
L33: const mod = await import(pathToFileURL(out).href);
L34: const factory = mod.default;
Findings
5 High6 Medium5 Low
HighChild Processdist/lib/optimize/workspace.js
HighShelldist/lib/runtime/ipc.js
HighSame File Env Network Executiondist/lib/stdlib/oauth.js
HighSemantic Analysis Limiteddist/lib/cli/commands.js#virtual:normalized:round1
HighPrevious Version Dangerous Deltadist/lib/cli/commands.js
MediumDynamic Requiredist/lib/optimize/optimizerModule.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/lib/cli/schedule/backends/launchd.js
MediumShips Build Helperdist/lib/cli/mlxSpeechServer.py
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
Affected versions and remediation
This report applies to agency-lang@0.20.0.
See all versions of agency-lang for other recorded verdicts.
- Review the evidence and your use of agency-lang@0.20.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.