registry / agent-baba-d / 1.12.0

agent-baba-d@1.12.0

Flexible AI inference CLI tool supporting local models and cloud APIs

AI Security Review

scanned 3h ago · by lpm-firewall-ai

This is a user-invoked AI development CLI with real shell, npm publishing, and GitHub release capabilities. No install-time execution or covert exfiltration path is established.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

User runs an orchestration/workflow command, especially `workflow run publish-release`, or a runner task.

Impact

May execute shell commands in the current project, publish to npm, and create GitHub releases using available user credentials.

Mechanism

LLM/task-directed shell execution plus authenticated package and release actions.

Rationale

Source inspection does not show malware, lifecycle abuse, covert exfiltration, or foreign AI-agent control-surface mutation. It does expose high-impact, LLM-directed developer automation without an explicit confirmation gate, which is a dangerous dual-use capability.

Evidence

package.jsondist/index.jsdist/workflow/templates.jsdist/agents/orchestrator.jsdist/agents/agents/runner.jsdist/agents/agents/package-agent.jsdist/agents/agents/github-release-agent.jsdist/agents/agents/tester.jsdist/plugins/agent-plugin.jsdist/config/manager.jsCHANGELOG.md~/.buff/buffconfig.json

Network endpoints6

api.github.com/repos/${repo}/releasesintegrate.api.nvidia.com/v1generativelanguage.googleapis.com/v1beta/modelsopenrouter.ai/api/v1api.groq.com/openai/v1localhost:11434

Decision evidence

public snapshot

AI called this Suspicious at 89.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

`dist/agents/agents/runner.js` passes task/LLM-derived commands to `execSync` with `/bin/sh`.
`dist/workflow/templates.js` exposes a user-invoked `publish-release` workflow that selects the package agent.
`dist/agents/agents/package-agent.js` runs `npm publish` and writes the target project's `package.json`.
`dist/agents/agents/github-release-agent.js` can use `GH_TOKEN`/`GITHUB_API_KEY` to create GitHub releases.
`dist/agents/agents/tester.js` runs `npm install` and project test scripts in a copied sandbox.

Evidence against

`package.json` has no `preinstall`, `install`, or `postinstall` hook.
`dist/index.js` only starts the CLI after direct invocation.
Network adapters target declared LLM providers and the GitHub API; no covert endpoint was found.
Plugin loading is limited to explicit `plugins` commands and `~/.buff/agents` files.
No credential harvesting, stealth persistence, or destructive host action was found.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 58 file(s), 374 KB of source, external domains: api.github.com, api.groq.com, generativelanguage.googleapis.com, github.com, huggingface.co, integrate.api.nvidia.com, openrouter.ai, python.org

Source & flagged code

9 flagged

README.mdView file

Lines 128-168markdown

128 }

129 }

130}

131```

132

133### Environment Variables

134

135API keys can be set via environment variables instead of the config file. They take **priority** over the config file.

136

137| Variable | Provider | Required? |

138|---|---|---|

139| `NVIDIA_NIM_API_KEY` | NVIDIA NIM | Yes, unless using local |

140| `GEMINI_API_KEY` | Google Gemini | Yes, unless using local |

141| `OPENROUTER_API_KEY` | OpenRouter | Yes, unless using local |

142

143You can place a `.env` file in the project root or at `~/.buff/.env`:

144

145```env

146# ~/.buff/.env

147NVIDIA_NIM_API_KEY=nvapi-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

148GEMINI_API_KEY=AIzaSyxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

High

High Secret

Package contains a high-severity secret pattern.

README.mdView on unpkg · L148

149OPENROUTER_API_KEY=sk-or-v1-xxxxxxxxxxxxxxxxxxxxxxxxxxxx

150```

151

152---

153

154## CLI Commands

155

156### `agent-baba-d models` — Model Discovery (New in v1.1.0)

157

158List available models from any configured provider. Query each provider's model catalog without leaving the terminal.

159

160```bash

161# List models from the default provider

162agent-baba-d models

163

164# List models from a specific provider

165agent-baba-d models --provider nim

166agent-baba-d models --provider openrouter

167

168# Search for models by keyword

148patternName = google_api_key severity = high line = 148 matchedText = GEMINI_A...xxxx

High

Secret Pattern

Google API key in README.md

README.mdView on unpkg · L148

dist/agents/agents/git-agent.jsView file

Lines 1-37javascript

1/**

2 * GitAgent — Manages git operations for the publishing pipeline.

3 *

4 * Capabilities:

5 * - Create branches

6 * - Commit changes with auto-generated commit messages (via LLM)

7 * - Generate PR descriptions from git diff

8 * - Check git status

9 *

10 * This agent does NOT require an LLM for basic operations (status, branch, commit),

11 * but uses the LLM for generating commit messages and PR descriptions.

12 *

dist/agents/agents/runner.jsView file

Lines 47-87javascript

47 }

48 // 2. Execute the command

49 if (context.metadata.verboseLogging) {

50 logger.info(` Running: ${command}`);

51 }

52 // Allow timeout override via context.metadata.runnerTimeout

53 const timeoutMs = (typeof context.metadata.runnerTimeout

dist/plugins/agent-plugin.jsView file

Lines 27-67javascript

27 try {

28 mkdirSync(dir, { recursive: true });

29 }

30 catch { /* best-effort */ }

31 }

32 }

33}

34// ─── Auto-Discovery ─────────────────────────────────────────────────────────

35/**

dist/memory/embedder.jsView file

Lines 91-131javascript

91 maxTokens: 1024,

92 });

93 }

94 catch (err) {

95 logger.debug(`Embedding generation failed: ${err}`);

96 // Fallback: return a zero vector (will result in no meaningful matches)

97 return new Array(

dist/agents/agents/package-agent.jsView file

Lines 1-36javascript

1/**

2 * PackageAgent — Manages npm package operations for the publishing pipeline.

3 *

4 * Capabilities:

5 * - Bump version (patch, minor, major)

6 * - Build project

7 * - Generate changelog from git log

8 * - Publish to npm

9 *

10 * Usage in task plans:

11 * ```json

12 * { "id": "step-publish", "description": "Bump version and publish to npm", "agentType": "package", "dependsOn": ["step-test"] }

dist/agents/agents/tester.jsView file

Lines 178-218javascript

178 * Apply the file changes from the execution context to the sandbox.

179 */

180 applyChangesToSandbox(sandboxPath, changes) {

181 for (const change of changes) {

182 if (change.status === 'deleted')

183 continue;

Source & flagged code

9 flagged · loading source

README.mdView file

148patternName = google_api_key severity = high line = 148 matchedText = GEMINI_A...xxxx

High

High Secret

Package contains a high-severity secret pattern.

README.mdView on unpkg · L148

148patternName = google_api_key severity = high line = 148 matchedText = GEMINI_A...xxxx

High

Secret Pattern

Google API key in README.md

README.mdView on unpkg · L148

dist/agents/agents/git-agent.jsView file

17*/ L18: import { execSync } from 'node:child_process'; L19: import { writeFileSync, unlinkSync, mkdtempSync } from 'node:fs';

High

Child Process

Package source references child process execution.

dist/agents/agents/git-agent.jsView on unpkg · L17

dist/agents/agents/runner.jsView file

67// Use shell so we can run python, node, bash scripts etc. L68: shell: platform() === 'win32' ? (process.env.COMSPEC || 'cmd.exe') : '/bin/sh', L69: // Max buffer size: 1 MB

High

Shell

Package source references shell execution.

dist/agents/agents/runner.jsView on unpkg · L67

dist/plugins/agent-plugin.jsView file

47// Dynamic import for ESM compatibility L48: const plugin = await import(pluginPath); L49: if (!plugin.default || !plugin.default.metadata) {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/plugins/agent-plugin.jsView on unpkg · L47

dist/memory/embedder.jsView file

111try { L112: const parsed = JSON.parse(trimmed); L113: if (isValidEmbedding(parsed))

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/memory/embedder.jsView on unpkg · L111

dist/agents/agents/package-agent.jsView file

16import { join } from 'node:path'; L17: import { execSync } from 'node:child_process'; L18: import { Agent } from '../agent.js'; ... L43: name = 'Package'; L44: description = 'Manages package version, build, and npm publish'; L45: async execute(context, callLLM) { ... L87: async bumpVersion(context, description) { L88: const pkgPath = join(context.workingDirectory, 'package.json'); L89: if (!existsSync(pkgPath)) { ... L91: } L92: const pkg = JSON.parse(readFileSync(pkgPath, 'utf-8')); L93: const currentVersion = pkg.version || '0.0.0';

Critical

Npm Publish Worm

Source mutates package metadata and republishes itself to npm.

dist/agents/agents/package-agent.jsView on unpkg · L16

16Trigger-reachable chain: manifest.main -> dist/index.js -> dist/agents/orchestrator.js -> dist/agents/agents/package-agent.js L16: import { join } from 'node:path'; L17: import { execSync } from 'node:child_process'; L18: import { Agent } from '../agent.js'; ... L43: name = 'Package'; L44: description = 'Manages package version, build, and npm publish'; L45: async execute(context, callLLM) { ... L87: async bumpVersion(context, description) { L88: const pkgPath = join(context.workingDirectory, 'package.json'); L89: if (!existsSync(pkgPath)) { ... L91: } L92: const pkg = JSON.parse(readFileSync(pkgPath, 'utf-8')); L93: const currentVersion = pkg.version || '0.0.0';

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/agents/agents/package-agent.jsView on unpkg · L16

dist/agents/agents/tester.jsView file

198try { L199: return execSync('npm install --prefer-offline --no-audit --no-fund 2>&1', { L200: cwd: sandboxPath,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/agents/agents/tester.jsView on unpkg · L198

Findings

2 Critical5 High4 Medium5 Low

CriticalNpm Publish Wormdist/agents/agents/package-agent.js

CriticalTrigger Reachable Dangerous Capabilitydist/agents/agents/package-agent.js

HighHigh SecretREADME.md

HighChild Processdist/agents/agents/git-agent.js

HighShelldist/agents/agents/runner.js

HighRuntime Package Installdist/agents/agents/tester.js

HighSecret PatternREADME.md

MediumDynamic Requiredist/plugins/agent-plugin.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowWeak Cryptodist/memory/embedder.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

9 flagged

README.mdView file

Lines 128-168markdown

128 }

129 }

130}

131```

132

133### Environment Variables

134

135API keys can be set via environment variables instead of the config file. They take **priority** over the config file.

136

137| Variable | Provider | Required? |

138|---|---|---|

139| `NVIDIA_NIM_API_KEY` | NVIDIA NIM | Yes, unless using local |

140| `GEMINI_API_KEY` | Google Gemini | Yes, unless using local |

141| `OPENROUTER_API_KEY` | OpenRouter | Yes, unless using local |

142

143You can place a `.env` file in the project root or at `~/.buff/.env`:

144

145```env

146# ~/.buff/.env

147NVIDIA_NIM_API_KEY=nvapi-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

148GEMINI_API_KEY=AIzaSyxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

High

High Secret

Package contains a high-severity secret pattern.

README.mdView on unpkg · L148

149OPENROUTER_API_KEY=sk-or-v1-xxxxxxxxxxxxxxxxxxxxxxxxxxxx

150```

151

152---

153

154## CLI Commands

155

156### `agent-baba-d models` — Model Discovery (New in v1.1.0)

157

158List available models from any configured provider. Query each provider's model catalog without leaving the terminal.

159

160```bash

161# List models from the default provider

162agent-baba-d models

163

164# List models from a specific provider

165agent-baba-d models --provider nim

166agent-baba-d models --provider openrouter

167

168# Search for models by keyword

148patternName = google_api_key severity = high line = 148 matchedText = GEMINI_A...xxxx

High

Secret Pattern

Google API key in README.md

README.mdView on unpkg · L148

dist/agents/agents/git-agent.jsView file

Lines 1-37javascript

1/**

2 * GitAgent — Manages git operations for the publishing pipeline.

3 *

4 * Capabilities:

5 * - Create branches

6 * - Commit changes with auto-generated commit messages (via LLM)

7 * - Generate PR descriptions from git diff

8 * - Check git status

9 *

10 * This agent does NOT require an LLM for basic operations (status, branch, commit),

11 * but uses the LLM for generating commit messages and PR descriptions.

12 *

dist/agents/agents/runner.jsView file

Lines 47-87javascript

47 }

48 // 2. Execute the command

49 if (context.metadata.verboseLogging) {

50 logger.info(` Running: ${command}`);

51 }

52 // Allow timeout override via context.metadata.runnerTimeout

53 const timeoutMs = (typeof context.metadata.runnerTimeout

dist/plugins/agent-plugin.jsView file

Lines 27-67javascript

27 try {

28 mkdirSync(dir, { recursive: true });

29 }

30 catch { /* best-effort */ }

31 }

32 }

33}

35/**

dist/memory/embedder.jsView file

Lines 91-131javascript

91 maxTokens: 1024,

92 });

93 }

94 catch (err) {

95 logger.debug(`Embedding generation failed: ${err}`);

96 // Fallback: return a zero vector (will result in no meaningful matches)

97 return new Array(

dist/agents/agents/package-agent.jsView file

Lines 1-36javascript

1/**

2 * PackageAgent — Manages npm package operations for the publishing pipeline.

3 *

4 * Capabilities:

5 * - Bump version (patch, minor, major)

6 * - Build project

7 * - Generate changelog from git log

8 * - Publish to npm

9 *

10 * Usage in task plans:

11 * ```json

12 * { "id": "step-publish", "description": "Bump version and publish to npm", "agentType": "package", "dependsOn": ["step-test"] }

dist/agents/agents/tester.jsView file

Lines 178-218javascript

178 * Apply the file changes from the execution context to the sandbox.

179 */

180 applyChangesToSandbox(sandboxPath, changes) {

181 for (const change of changes) {

182 if (change.status === 'deleted')

183 continue;