agency-orchestrator: Suspicious npm security report (Warn)

Loading npm security reports…

agency-orchestrator: Suspicious npm security report (Warn) | LPM Firewall

AI called this Suspicious at 93.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

`dist/cli/install.js` copies packaged role prompts into Claude, Copilot, Gemini, Qwen, Cursor, and OpenCode agent directories.
`web/server.js` POST `/api/config` calls `applyCodexRelay`, which writes `~/.codex/config.toml` and `~/.codex/auth.json` from submitted relay settings.
`web/server.js` fetches a remote provider manifest from `https://ao.aiolaola.com/providers-manifest.json` at local Web Studio startup.
`dist/connectors/cli-base.js` intentionally launches user-selected local AI CLIs to run workflow prompts.

Evidence against

`package.json` has only `prepublishOnly`; it declares no `preinstall`, `install`, `postinstall`, or `prepare` hook.
Agent and Codex configuration writes require explicit `ao install` use or a local Web Studio configuration POST.
No evaluated remote code, `eval`, VM execution, native binaries, credential harvesting, or covert exfiltration was found.
`agency-agents/integrations/mcp-memory/setup.sh` only prints setup guidance and does not modify MCP configuration.

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 91 file(s), 2.36 MB of source, external domains: aiolaola.com, aistudio.google.com, animeai.online, ao.aiolaola.com, api.anthropic.com, api.cubence.com, api.deepseek.com, api.dicebear.com, api.example.com, api.mistral.ai, api.modelverse.cn, api.moonshot.cn, api.openai.com, api.rootflowai.com, api.siliconflow.cn, apihub.agnes-ai.com, apinebula.com, ark.cn-beijing.volces.com, cms-assets.youmind.com, commons.wikimedia.org, console.anthropic.com, creativecommons.org, cubence.com, dashscope.aliyuncs.com, duoyuanx.com, fb.me, github.com, host.docker.internal, models.dev, open.bigmodel.cn, passport.compshare.cn, platform.deepseek.com, platform.openai.com, pro.reactflow.dev, prompts.aiolaola.com, raw.githubusercontent.com, reactflow.dev, reactjs.org, registry.npmjs.org, rootflowai.com, semver.org, sora.com, t.co, www.byteplus.com, www.ccsub.net, www.npmjs.com, www.volcengine.com, www.w3.org, x.com

Source & flagged code

10 flagged

dist/connectors/cli-base.jsView file

Lines 1-40javascript

1/**

2 * CLI Connector 通用基类

3 * 通过本地 AI CLI 工具调用，使用用户的订阅额度，无需 API key

4 *

5 * 支持: Claude Code / Gemini CLI / Copilot CLI / Codex CLI / OpenClaw CLI

6 *

7 * 当 prompt 过长（超过 ARG_MAX 安全阈值）时，自动切换为 stdin 传输，

8 * 避免 ENAMETOOLONG 错误（GitHub issue #1）

9 */

10import { spawn } from 'node:child_process';

11import { t } from '../i18n.js';

High

Child Process

Package source references child process execution.

dist/connectors/cli-base.jsView on unpkg · L9

12/**

13 * 命令行参数安全长度上限

14 * claude -p 等 CLI 工具通过命令行参数传大 prompt 会严重变慢

15 * （12KB prompt: 命令行参数 330s+ vs stdin 61s）

16 * 设为 4KB，超过就自动走 stdin

17 */

18const ARG_SAFE_LIMIT = 4 * 1024;

19/**

20 * 解码子进程输出。Windows 下这些 CLI 都用 shell:true 启动（npm 全局装的是 .cmd

21 * shim，spawn 不走 shell 执行不了），一旦命令找不到，报错是 cmd.exe 自己吐的

22 * "'gemini' 不是内部或外部命令..."，用的是系统当前 ANSI/OEM 代码页（中文 Windows

High

Shell

Package source references shell execution.

dist/connectors/cli-base.jsView on unpkg · L20

23 * 通常是 GBK/CP936），不是 UTF-8。之前直接 toString('utf8') 会把这段本来很清楚的

24 * 报错解码成乱码，用户看到的是一堆问号方块，完全看不出"其实是命令没装/不在 PATH"。

25 * 这里先按严格 UTF-8 校验，非法字节序列（真正的 CLI 输出都应该是合法 UTF-8）就

26 * 判定为别的代码页，回退按 GBK 解码——对中文 Windows 用户是压倒性最常见的情况。

27 */

28export function decodeProcessOutput(chunks) {

29 const buf = Buffer.concat(chunks);

30 if (buf.length === 0)

31 return '';

32 try {

33 return new TextDecoder('utf-8', { fatal: true }).decode(buf);

34 }

35 catch {

36 if (process.platform === 'win32') {

37 try {

38 return new TextDecoder('gbk').decode(buf);

39 }

40 catch {

dist/cli/demo.jsView file

Lines 10-50javascript

10 */

11import { resolve, dirname } from 'node:path';

12import { fileURLToPath } from 'node:url';

13import { existsSync } from 'node:fs';

14import { createInterface }

agency-agents/integrations/mcp-memory/setup.shView file

•path = agency-agents/integrations/mcp-memory/setup.sh kind = build_helper sizeBytes = 2227 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

agency-agents/integrations/mcp-memory/setup.shView on unpkg

dist/cli.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = agency-orchestrator@0.9.0 matchedIdentity = npm:YWdlbmN5LW9yY2hlc3RyYXRvcg:0.9.0 similarity = 0.828 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli.jsView on unpkg

website/dist/prompts/zh/testing/testing-api-tester.mdView file

Lines 49-89markdown

50## 你的技术交付物

52### 全面的 API 测试套件示例

53```javascript

54// 包含安全和性能的高级 API 测试自动化

55import { test, expect } from '@playwright/test';

56import { performance } from 'perf_hooks';

website/dist/prompts/en/testing/testing-api-tester.mdView file

Lines 49-89markdown

50## 📋 Your Technical Deliverables

52### Comprehensive API Test Suite Example

53```javascript

54// Advanced API test automation with security and performance

55import { test, expect } from '@playwright/test';

56import { performance } from 'perf_hooks'

website/dist/prompts/en/testing/testing-performance-benchmarker.mdView file

Lines 65-105markdown

65 { duration: '2m', target: 10 }, // Warm up

66 { duration: '5m', target: 50 }, // Normal load

67 { duration: '2m', target: 100 }, // Peak load

68 { duration: '5m', target: 100 }, // Sustained peak

69 { duration: '2m', target: 200 }, // Stress test

70 { duration: '3m', target: 0 }, // Cool down

71 ],

72 thresholds: {

73 http_req_duration: ['p(95)<500'], // 95% under 500ms

agency-agents/testing/testing-api-tester.mdView file

Lines 57-97markdown

58## 📋 Your Technical Deliverables

60### Comprehensive API Test Suite Example

61```javascript

62// Advanced API test automation with security and performance

63import { test, expect } from '@playwright/test';

64import { performance } from 'perf_hooks'

agency-agents/testing/testing-performance-benchmarker.mdView file

Lines 73-113markdown

73 { duration: '2m', target: 10 }, // Warm up

74 { duration: '5m', target: 50 }, // Normal load

75 { duration: '2m', target: 100 }, // Peak load

76 { duration: '5m', target: 100 }, // Sustained peak

77 { duration: '2m', target: 200 }, // Stress test

78 { duration: '3m', target: 0 }, // Cool down

79 ],

80 thresholds: {

81 http_req_duration: ['p(95)<500'], // 95% under 500ms

Source & flagged code

10 flagged · loading source

dist/connectors/cli-base.jsView file

9*/ L10: import { spawn } from 'node:child_process'; L11: import { t } from '../i18n.js';

High

Child Process

Package source references child process execution.

dist/connectors/cli-base.jsView on unpkg · L9

20* 解码子进程输出。Windows 下这些 CLI 都用 shell:true 启动（npm 全局装的是 .cmd L21: * shim，spawn 不走 shell 执行不了），一旦命令找不到，报错是 cmd.exe 自己吐的 L22: * "'gemini' 不是内部或外部命令..."，用的是系统当前 ANSI/OEM 代码页（中文 Windows

High

Shell

Package source references shell execution.

dist/connectors/cli-base.jsView on unpkg · L20

dist/cli/demo.jsView file

30try { L31: const { execSync } = await import('node:child_process'); L32: execSync(`which ${tool.cmd}`, { stdio: 'ignore' }); ... L42: const timeout = setTimeout(() => controller.abort(), 2000); L43: const ollamaUrl = process.env.OLLAMA_BASE_URL || 'http://localhost:11434'; L44: const res = await fetch(`${ollamaUrl.replace(/\/+$/, '')}/api/tags`, {

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli/demo.jsView on unpkg · L30

agency-agents/integrations/mcp-memory/setup.shView file

•path = agency-agents/integrations/mcp-memory/setup.sh kind = build_helper sizeBytes = 2227 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

agency-agents/integrations/mcp-memory/setup.shView on unpkg

dist/cli.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli.jsView on unpkg

website/dist/prompts/zh/testing/testing-api-tester.mdView file

69patternName = generic_password severity = medium line = 69 matchedText = password...ord'

Medium

Secret Pattern

Hardcoded password in website/dist/prompts/zh/testing/testing-api-tester.md

website/dist/prompts/zh/testing/testing-api-tester.mdView on unpkg · L69

website/dist/prompts/en/testing/testing-api-tester.mdView file

69patternName = generic_password severity = medium line = 69 matchedText = password...ord'

Medium

Secret Pattern

Hardcoded password in website/dist/prompts/en/testing/testing-api-tester.md

website/dist/prompts/en/testing/testing-api-tester.mdView on unpkg · L69

website/dist/prompts/en/testing/testing-performance-benchmarker.mdView file

85patternName = generic_password severity = medium line = 85 matchedText = password...123'

Medium

Secret Pattern

Hardcoded password in website/dist/prompts/en/testing/testing-performance-benchmarker.md

website/dist/prompts/en/testing/testing-performance-benchmarker.mdView on unpkg · L85

agency-agents/testing/testing-api-tester.mdView file

77patternName = generic_password severity = medium line = 77 matchedText = password...ord'

Medium

Secret Pattern

Hardcoded password in agency-agents/testing/testing-api-tester.md

agency-agents/testing/testing-api-tester.mdView on unpkg · L77

agency-agents/testing/testing-performance-benchmarker.mdView file

93patternName = generic_password severity = medium line = 93 matchedText = password...123'

Medium

Secret Pattern

Hardcoded password in agency-agents/testing/testing-performance-benchmarker.md

agency-agents/testing/testing-performance-benchmarker.mdView on unpkg · L93

Source & flagged code

10 flagged

dist/connectors/cli-base.jsView file

Lines 1-40javascript

1/**

2 * CLI Connector 通用基类

3 * 通过本地 AI CLI 工具调用，使用用户的订阅额度，无需 API key

4 *

5 * 支持: Claude Code / Gemini CLI / Copilot CLI / Codex CLI / OpenClaw CLI

6 *

7 * 当 prompt 过长（超过 ARG_MAX 安全阈值）时，自动切换为 stdin 传输，

8 * 避免 ENAMETOOLONG 错误（GitHub issue #1）

9 */

10import { spawn } from 'node:child_process';

11import { t } from '../i18n.js';

High

Child Process

Package source references child process execution.

dist/connectors/cli-base.jsView on unpkg · L9

12/**

13 * 命令行参数安全长度上限

14 * claude -p 等 CLI 工具通过命令行参数传大 prompt 会严重变慢

15 * （12KB prompt: 命令行参数 330s+ vs stdin 61s）

16 * 设为 4KB，超过就自动走 stdin

17 */

18const ARG_SAFE_LIMIT = 4 * 1024;

19/**

20 * 解码子进程输出。Windows 下这些 CLI 都用 shell:true 启动（npm 全局装的是 .cmd

21 * shim，spawn 不走 shell 执行不了），一旦命令找不到，报错是 cmd.exe 自己吐的

22 * "'gemini' 不是内部或外部命令..."，用的是系统当前 ANSI/OEM 代码页（中文 Windows

High

Shell

Package source references shell execution.

dist/connectors/cli-base.jsView on unpkg · L20

23 * 通常是 GBK/CP936），不是 UTF-8。之前直接 toString('utf8') 会把这段本来很清楚的

24 * 报错解码成乱码，用户看到的是一堆问号方块，完全看不出"其实是命令没装/不在 PATH"。

25 * 这里先按严格 UTF-8 校验，非法字节序列（真正的 CLI 输出都应该是合法 UTF-8）就

26 * 判定为别的代码页，回退按 GBK 解码——对中文 Windows 用户是压倒性最常见的情况。

27 */

28export function decodeProcessOutput(chunks) {

29 const buf = Buffer.concat(chunks);

30 if (buf.length === 0)

31 return '';

32 try {

33 return new TextDecoder('utf-8', { fatal: true }).decode(buf);

34 }

35 catch {

36 if (process.platform === 'win32') {

37 try {

38 return new TextDecoder('gbk').decode(buf);

39 }

40 catch {

dist/cli/demo.jsView file

Lines 10-50javascript

10 */

11import { resolve, dirname } from 'node:path';

12import { fileURLToPath } from 'node:url';

13import { existsSync } from 'node:fs';

14import { createInterface }

agency-agents/integrations/mcp-memory/setup.shView file

•path = agency-agents/integrations/mcp-memory/setup.sh kind = build_helper sizeBytes = 2227 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

agency-agents/integrations/mcp-memory/setup.shView on unpkg

dist/cli.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli.jsView on unpkg

website/dist/prompts/zh/testing/testing-api-tester.mdView file

Lines 49-89markdown

50## 你的技术交付物

52### 全面的 API 测试套件示例

53```javascript

54// 包含安全和性能的高级 API 测试自动化

55import { test, expect } from '@playwright/test';

56import { performance } from 'perf_hooks';

website/dist/prompts/en/testing/testing-api-tester.mdView file

Lines 49-89markdown

50## 📋 Your Technical Deliverables

52### Comprehensive API Test Suite Example

53```javascript

54// Advanced API test automation with security and performance

55import { test, expect } from '@playwright/test';

56import { performance } from 'perf_hooks'

website/dist/prompts/en/testing/testing-performance-benchmarker.mdView file

Lines 65-105markdown

65 { duration: '2m', target: 10 }, // Warm up

66 { duration: '5m', target: 50 }, // Normal load

67 { duration: '2m', target: 100 }, // Peak load

68 { duration: '5m', target: 100 }, // Sustained peak

69 { duration: '2m', target: 200 }, // Stress test

70 { duration: '3m', target: 0 }, // Cool down

71 ],

72 thresholds: {

73 http_req_duration: ['p(95)<500'], // 95% under 500ms

agency-agents/testing/testing-api-tester.mdView file

Lines 57-97markdown

58## 📋 Your Technical Deliverables

60### Comprehensive API Test Suite Example

61```javascript

62// Advanced API test automation with security and performance

63import { test, expect } from '@playwright/test';

64import { performance } from 'perf_hooks'

agency-agents/testing/testing-performance-benchmarker.mdView file

Lines 73-113markdown

73 { duration: '2m', target: 10 }, // Warm up

74 { duration: '5m', target: 50 }, // Normal load

75 { duration: '2m', target: 100 }, // Peak load

76 { duration: '5m', target: 100 }, // Sustained peak

77 { duration: '2m', target: 200 }, // Stress test

78 { duration: '3m', target: 0 }, // Cool down

79 ],

80 thresholds: {

81 http_req_duration: ['p(95)<500'], // 95% under 500ms

agency-orchestrator@0.11.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code