agent-cards@0.8.3
CLI for managing virtual debit cards for AI agents
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe package sends default runtime telemetry to its own analytics host and documents an opt-out, but it uses the signed-in email as the event identity without disclosing that collection. This is a telemetry disclosure concern; the reviewed source does not show credential theft or another concrete attack.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A CLI command or lifecycle event that calls the telemetry capture functions while telemetry is enabled.
Impact
The package's analytics service receives the user's account email alongside telemetry events.
Mechanism
The analytics client uses the email from the local Agent Cards configuration as the event distinct ID and sends captured events to the configured PostHog host.
AI rationale
The package sends default runtime telemetry to its own analytics host and documents an opt-out, but it uses the signed-in email as the event identity without disclosing that collection. This is a telemetry disclosure concern; the reviewed source does not show credential theft or another concrete attack.
Evidence
dist/src/lib/posthog.jsREADME.mddist/src/lib/config.js~/.agent-cards/config.json
Network endpoints1
t.agentcard.sh
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Runtime analytics use the signed-in email from local configuration as the event identity and send it with captured events.
- The README describes lifecycle and error telemetry and provides an opt-out, but does not disclose that the signed-in email is used as the analytics identity.
Evidence against
- Telemetry is sent to the package's own host, and users can disable it with documented environment variables.
- The captured properties are limited to lifecycle metadata such as the registered command path and terminal status; the source says command arguments and secrets are excluded.
- Agent instruction files are changed by an explicit `agents add` command; automatic refresh only updates files already carrying the package's managed marker.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStrings
Source & flagged code
6 flaggeddist/src/integrate/git.jsView file
1import { execFileSync } from 'child_process';
L2: import { branchNameFor } from './session.js';
High
Child Process
Package source references child process execution.
dist/src/integrate/git.jsView on unpkg · L1dist/src/commands/api.jsView file
23if (existsSync(p)) {
L24: return (await import(pathToFileURL(p).href));
L25: }
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/src/commands/api.jsView on unpkg · L23dist/src/commands/agents.jsView file
•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation.
import { existssync, mkdirsync, readfilesync, writefilesync } from 'fs';
import { homedir } from 'os';
import { dirname, join, resolve } from 'path';
import chalk from 'chalk';
import { glyphs } from '../lib/ui.js';
import inquirer from 'inquirer';
import { readconfig, writeconfig } from '../lib/config.js';
import { ensureglobalinstall } from '../lib/global-install.js';
import { captureevent } from '../lib/posthog.js';
Findings
1 Critical5 High4 Medium7 Low
CriticalPrevious Version Dangerous Deltadist/src/integrate/docs-index.js
HighChild Processdist/src/integrate/git.js
HighShell
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/src/commands/agents.js
HighRuntime Package Installdist/src/lib/global-install.js
HighSemantic Analysis Limiteddist/src/commands/api.js#virtual:normalized:round1
MediumDynamic Requiredist/src/commands/api.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
Affected versions and remediation
This report applies to agent-cards@0.8.3.
See all versions of agent-cards for other recorded verdicts.
- Review the evidence and your use of agent-cards@0.8.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.