agency-orchestrator@0.9.0: Suspicious npm security report (Warn)

Loading npm security reports…

agency-orchestrator@0.9.0: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

9 flagged

dist/connectors/cli-base.jsView file

Lines 1-40javascript

1/**

2 * CLI Connector 通用基类

3 * 通过本地 AI CLI 工具调用，使用用户的订阅额度，无需 API key

4 *

5 * 支持: Claude Code / Gemini CLI / Copilot CLI / Codex CLI / OpenClaw CLI

6 *

7 * 当 prompt 过长（超过 ARG_MAX 安全阈值）时，自动切换为 stdin 传输，

8 * 避免 ENAMETOOLONG 错误（GitHub issue #1）

9 */

10import { spawn } from 'node:child_process';

11import { t } from '../i18n.js';

High

Child Process

Package source references child process execution.

dist/connectors/cli-base.jsView on unpkg · L9

12/**

13 * 命令行参数安全长度上限

14 * claude -p 等 CLI 工具通过命令行参数传大 prompt 会严重变慢

15 * （12KB prompt: 命令行参数 330s+ vs stdin 61s）

16 * 设为 4KB，超过就自动走 stdin

17 */

18const ARG_SAFE_LIMIT = 4 * 1024;

19/**

20 * 解码子进程输出。Windows 下这些 CLI 都用 shell:true 启动（npm 全局装的是 .cmd

21 * shim，spawn 不走 shell 执行不了），一旦命令找不到，报错是 cmd.exe 自己吐的

22 * "'gemini' 不是内部或外部命令..."，用的是系统当前 ANSI/OEM 代码页（中文 Windows

High

Shell

Package source references shell execution.

dist/connectors/cli-base.jsView on unpkg · L20

23 * 通常是 GBK/CP936），不是 UTF-8。之前直接 toString('utf8') 会把这段本来很清楚的

24 * 报错解码成乱码，用户看到的是一堆问号方块，完全看不出"其实是命令没装/不在 PATH"。

25 * 这里先按严格 UTF-8 校验，非法字节序列（真正的 CLI 输出都应该是合法 UTF-8）就

26 * 判定为别的代码页，回退按 GBK 解码——对中文 Windows 用户是压倒性最常见的情况。

27 */

28export function decodeProcessOutput(chunks) {

29 const buf = Buffer.concat(chunks);

30 if (buf.length === 0)

31 return '';

32 try {

33 return new TextDecoder('utf-8', { fatal: true }).decode(buf);

34 }

35 catch {

36 if (process.platform === 'win32') {

37 try {

38 return new TextDecoder('gbk').decode(buf);

39 }

40 catch {

dist/cli/demo.jsView file

Lines 10-50javascript

10 */

11import { resolve, dirname } from 'node:path';

12import { fileURLToPath } from 'node:url';

13import { existsSync } from 'node:fs';

14import { createInterface } from

agency-agents/integrations/mcp-memory/setup.shView file

•path = agency-agents/integrations/mcp-memory/setup.sh kind = build_helper sizeBytes = 2227 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

agency-agents/integrations/mcp-memory/setup.shView on unpkg

website/dist/prompts/zh/testing/testing-api-tester.mdView file

Lines 49-89markdown

50## 你的技术交付物

52### 全面的 API 测试套件示例

53```javascript

54// 包含安全和性能的高级 API 测试自动化

55import { test, expect } from '@playwright/test';

56import { performance } from 'perf_hooks';

website/dist/prompts/en/testing/testing-api-tester.mdView file

Lines 49-89markdown

50## 📋 Your Technical Deliverables

52### Comprehensive API Test Suite Example

53```javascript

54// Advanced API test automation with security and performance

55import { test, expect } from '@playwright/test';

56import { performance } from 'perf_hooks'

website/dist/prompts/en/testing/testing-performance-benchmarker.mdView file

Lines 65-105markdown

65 { duration: '2m', target: 10 }, // Warm up

66 { duration: '5m', target: 50 }, // Normal load

67 { duration: '2m', target: 100 }, // Peak load

68 { duration: '5m', target: 100 }, // Sustained peak

69 { duration: '2m', target: 200 }, // Stress test

70 { duration: '3m', target: 0 }, // Cool down

71 ],

72 thresholds: {

73 http_req_duration: ['p(95)<500'], // 95% under 500ms

agency-agents/testing/testing-api-tester.mdView file

Lines 57-97markdown

58## 📋 Your Technical Deliverables

60### Comprehensive API Test Suite Example

61```javascript

62// Advanced API test automation with security and performance

63import { test, expect } from '@playwright/test';

64import { performance } from 'perf_hooks'

agency-agents/testing/testing-performance-benchmarker.mdView file

Lines 73-113markdown

73 { duration: '2m', target: 10 }, // Warm up

74 { duration: '5m', target: 50 }, // Normal load

75 { duration: '2m', target: 100 }, // Peak load

76 { duration: '5m', target: 100 }, // Sustained peak

77 { duration: '2m', target: 200 }, // Stress test

78 { duration: '3m', target: 0 }, // Cool down

79 ],

80 thresholds: {

81 http_req_duration: ['p(95)<500'], // 95% under 500ms

Source & flagged code

9 flagged · loading source

dist/connectors/cli-base.jsView file

9*/ L10: import { spawn } from 'node:child_process'; L11: import { t } from '../i18n.js';

High

Child Process

Package source references child process execution.

dist/connectors/cli-base.jsView on unpkg · L9

20* 解码子进程输出。Windows 下这些 CLI 都用 shell:true 启动（npm 全局装的是 .cmd L21: * shim，spawn 不走 shell 执行不了），一旦命令找不到，报错是 cmd.exe 自己吐的 L22: * "'gemini' 不是内部或外部命令..."，用的是系统当前 ANSI/OEM 代码页（中文 Windows

High

Shell

Package source references shell execution.

dist/connectors/cli-base.jsView on unpkg · L20

dist/cli/demo.jsView file

30try { L31: const { execSync } = await import('node:child_process'); L32: execSync(`which ${tool.cmd}`, { stdio: 'ignore' }); ... L42: const timeout = setTimeout(() => controller.abort(), 2000); L43: const ollamaUrl = process.env.OLLAMA_BASE_URL || 'http://localhost:11434'; L44: const res = await fetch(`${ollamaUrl.replace(/\/+$/, '')}/api/tags`, {

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli/demo.jsView on unpkg · L30

agency-agents/integrations/mcp-memory/setup.shView file

•path = agency-agents/integrations/mcp-memory/setup.sh kind = build_helper sizeBytes = 2227 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

agency-agents/integrations/mcp-memory/setup.shView on unpkg

website/dist/prompts/zh/testing/testing-api-tester.mdView file

69patternName = generic_password severity = medium line = 69 matchedText = password...ord'

Medium

Secret Pattern

Hardcoded password in website/dist/prompts/zh/testing/testing-api-tester.md

website/dist/prompts/zh/testing/testing-api-tester.mdView on unpkg · L69

website/dist/prompts/en/testing/testing-api-tester.mdView file

69patternName = generic_password severity = medium line = 69 matchedText = password...ord'

Medium

Secret Pattern

Hardcoded password in website/dist/prompts/en/testing/testing-api-tester.md

website/dist/prompts/en/testing/testing-api-tester.mdView on unpkg · L69

website/dist/prompts/en/testing/testing-performance-benchmarker.mdView file

85patternName = generic_password severity = medium line = 85 matchedText = password...123'

Medium

Secret Pattern

Hardcoded password in website/dist/prompts/en/testing/testing-performance-benchmarker.md

website/dist/prompts/en/testing/testing-performance-benchmarker.mdView on unpkg · L85

agency-agents/testing/testing-api-tester.mdView file

77patternName = generic_password severity = medium line = 77 matchedText = password...ord'

Medium

Secret Pattern

Hardcoded password in agency-agents/testing/testing-api-tester.md

agency-agents/testing/testing-api-tester.mdView on unpkg · L77

agency-agents/testing/testing-performance-benchmarker.mdView file

93patternName = generic_password severity = medium line = 93 matchedText = password...123'

Medium

Secret Pattern

Hardcoded password in agency-agents/testing/testing-performance-benchmarker.md

agency-agents/testing/testing-performance-benchmarker.mdView on unpkg · L93

Source & flagged code

9 flagged

dist/connectors/cli-base.jsView file

Lines 1-40javascript

1/**

2 * CLI Connector 通用基类

3 * 通过本地 AI CLI 工具调用，使用用户的订阅额度，无需 API key

4 *

5 * 支持: Claude Code / Gemini CLI / Copilot CLI / Codex CLI / OpenClaw CLI

6 *

7 * 当 prompt 过长（超过 ARG_MAX 安全阈值）时，自动切换为 stdin 传输，

8 * 避免 ENAMETOOLONG 错误（GitHub issue #1）

9 */

10import { spawn } from 'node:child_process';

11import { t } from '../i18n.js';

High

Child Process

Package source references child process execution.

dist/connectors/cli-base.jsView on unpkg · L9

12/**

13 * 命令行参数安全长度上限

14 * claude -p 等 CLI 工具通过命令行参数传大 prompt 会严重变慢

15 * （12KB prompt: 命令行参数 330s+ vs stdin 61s）

16 * 设为 4KB，超过就自动走 stdin

17 */

18const ARG_SAFE_LIMIT = 4 * 1024;

19/**

20 * 解码子进程输出。Windows 下这些 CLI 都用 shell:true 启动（npm 全局装的是 .cmd

21 * shim，spawn 不走 shell 执行不了），一旦命令找不到，报错是 cmd.exe 自己吐的

22 * "'gemini' 不是内部或外部命令..."，用的是系统当前 ANSI/OEM 代码页（中文 Windows

High

Shell

Package source references shell execution.

dist/connectors/cli-base.jsView on unpkg · L20

23 * 通常是 GBK/CP936），不是 UTF-8。之前直接 toString('utf8') 会把这段本来很清楚的

24 * 报错解码成乱码，用户看到的是一堆问号方块，完全看不出"其实是命令没装/不在 PATH"。

25 * 这里先按严格 UTF-8 校验，非法字节序列（真正的 CLI 输出都应该是合法 UTF-8）就

26 * 判定为别的代码页，回退按 GBK 解码——对中文 Windows 用户是压倒性最常见的情况。

27 */

28export function decodeProcessOutput(chunks) {

29 const buf = Buffer.concat(chunks);

30 if (buf.length === 0)

31 return '';

32 try {

33 return new TextDecoder('utf-8', { fatal: true }).decode(buf);

34 }

35 catch {

36 if (process.platform === 'win32') {

37 try {

38 return new TextDecoder('gbk').decode(buf);

39 }

40 catch {

dist/cli/demo.jsView file

Lines 10-50javascript

10 */

11import { resolve, dirname } from 'node:path';

12import { fileURLToPath } from 'node:url';

13import { existsSync } from 'node:fs';

14import { createInterface } from

agency-agents/integrations/mcp-memory/setup.shView file

•path = agency-agents/integrations/mcp-memory/setup.sh kind = build_helper sizeBytes = 2227 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

agency-agents/integrations/mcp-memory/setup.shView on unpkg

website/dist/prompts/zh/testing/testing-api-tester.mdView file

Lines 49-89markdown

50## 你的技术交付物

52### 全面的 API 测试套件示例

53```javascript

54// 包含安全和性能的高级 API 测试自动化

55import { test, expect } from '@playwright/test';

56import { performance } from 'perf_hooks';

website/dist/prompts/en/testing/testing-api-tester.mdView file

Lines 49-89markdown

50## 📋 Your Technical Deliverables

52### Comprehensive API Test Suite Example

53```javascript

54// Advanced API test automation with security and performance

55import { test, expect } from '@playwright/test';

56import { performance } from 'perf_hooks'

website/dist/prompts/en/testing/testing-performance-benchmarker.mdView file

Lines 65-105markdown

65 { duration: '2m', target: 10 }, // Warm up

66 { duration: '5m', target: 50 }, // Normal load

67 { duration: '2m', target: 100 }, // Peak load

68 { duration: '5m', target: 100 }, // Sustained peak

69 { duration: '2m', target: 200 }, // Stress test

70 { duration: '3m', target: 0 }, // Cool down

71 ],

72 thresholds: {

73 http_req_duration: ['p(95)<500'], // 95% under 500ms

agency-agents/testing/testing-api-tester.mdView file

Lines 57-97markdown

58## 📋 Your Technical Deliverables

60### Comprehensive API Test Suite Example

61```javascript

62// Advanced API test automation with security and performance

63import { test, expect } from '@playwright/test';

64import { performance } from 'perf_hooks'

agency-agents/testing/testing-performance-benchmarker.mdView file

Lines 73-113markdown

73 { duration: '2m', target: 10 }, // Warm up

74 { duration: '5m', target: 50 }, // Normal load

75 { duration: '2m', target: 100 }, // Peak load

76 { duration: '5m', target: 100 }, // Sustained peak

77 { duration: '2m', target: 200 }, // Stress test

78 { duration: '3m', target: 0 }, // Cool down

79 ],

80 thresholds: {

81 http_req_duration: ['p(95)<500'], // 95% under 500ms

agency-orchestrator@0.9.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code