agency-lang@0.38.0
The Agency language
AI Security Review
scanned 20h ago · by lpm-firewall-aiThe package includes a shipped agent that reports runtime exception messages to its configured statelog service, with no consent check visible in the reporting path. This is a telemetry concern rather than evidence of credential theft or unrelated data collection.
Static reason
One or more suspicious static signals were detected.
Trigger
The announce agent runs and catches an exception.
Impact
Error text may include identifying project or user context, creating undisclosed runtime telemetry risk.
Mechanism
Its catch handler calls the statelog client's error method with the exception message and function name; no consent check is visible in this path.
AI rationale
The package includes a shipped agent that reports runtime exception messages to its configured statelog service, with no consent check visible in the reporting path. This is a telemetry concern rather than evidence of credential theft or unrelated data collection.
Evidence
dist/lib/agents/agency-agent/brains/coordinator/subagents/announce.js
Network endpoints1
statelog.adit.io
Decision evidence
public snapshotAI called this Suspicious at 83.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The shipped announce agent configures observability to send data to https://statelog.adit.io, while its LLM provider keys are configured separately for the agent's model services.
- When announce throws, it sends the exception message to the statelog client as a runtimeError; this path shows no consent check or opt-out.
Evidence against
- The manifest points to a normal library entry and CLI, and its scripts section shows development and test commands rather than install hooks.
- Skill installation requires the user to choose an explicit destination.
- The launchd backend writes and loads a scheduled job only through its install method, consistent with an explicit scheduling feature.
- The ffmpeg helper transcodes audio to a temporary file and removes it afterward.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
Source & flagged code
6 flaggeddist/lib/optimize/optimizerModule.jsView file
32// eslint-disable-next-line no-restricted-syntax -- CLI-layer loading of a user artifact; the bundle path is only known at runtime
L33: const mod = await import(pathToFileURL(out).href);
L34: const factory = mod.default;
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/lib/optimize/optimizerModule.jsView on unpkg · L32dist/lib/cli/schedule/backends/launchd.jsView file
1import { execFileSync } from "child_process";
L2: import * as fs from "fs";
...
L6: import renderPlist from "../../../templates/cli/schedule/plist.js";
L7: const PLIST_DIR = path.join(os.homedir(), "Library", "LaunchAgents");
L8: function plistPath(name) {
...
L64: agentDir: path.dirname(entry.agentFile),
L65: path: process.env.PATH ?? "/usr/local/bin:/usr/bin:/bin",
L66: home: os.homedir(),
...
L71: fs.mkdirSync(PLIST_DIR, { recursive: true });
L72: // Unload first if already loaded (launchctl load fails on already-loaded plists)
L73: if (fs.existsSync(dest)) {
Medium
Install Persistence
Source writes installer persistence such as shell profile or service configuration.
dist/lib/cli/schedule/backends/launchd.jsFindings
3 High6 Medium5 Low
HighSandbox Evasion Gated Capabilitydist/lib/stdlib/ffmpeg.js
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/lib/cli/skills.js
HighSemantic Analysis Limiteddist/lib/cli/attach.js#virtual:normalized:round1
MediumDynamic Requiredist/lib/optimize/optimizerModule.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/lib/cli/schedule/backends/launchd.js
MediumShips Build Helperdist/lib/cli/mlxSpeechServer.py
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
Low
Affected versions and remediation
This report applies to agency-lang@0.38.0.
See all versions of agency-lang for other recorded verdicts.
- Review the evidence and your use of agency-lang@0.38.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.