registry / agent-nuvira / 1.14.1

agent-nuvira@1.14.1

Agent-Nuvira: Multi-agent AI coding CLI — plan, write, review, test, and publish code with local models (Ollama) or cloud APIs (Groq, NVIDIA NIM, Google Gemini, OpenRouter)

AI Security Review

scanned 2h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. The user-invoked CLI auto-loads JavaScript plugins from its own `~/.buff` extension directories and exposes agents that can run shell commands, install dependencies, edit a target project, and publish it. No install-time execution or confirmed malicious exfiltration was established.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Running the `agent-nuvira` CLI and invoking an agent/task that uses plugins, runner, tester, or package operations.

Impact

A user who runs untrusted tasks or places untrusted code in the package-owned plugin directories can cause local code execution; publish and project mutation actions are reachable through explicit task intent.

Mechanism

Package-owned plugin auto-loading plus agent-directed command execution.

Rationale

This is not concrete malware: there are no lifecycle hooks and the high-impact behavior is exposed through user-invoked agent workflows. It warrants a warning because startup plugin execution and host command fallback leave a meaningful dangerous-capability surface.

Evidence

package.jsondist/index.jsdist/plugins/agent-plugin.jsdist/agents/agents/runner.jsdist/agents/agents/tester.jsdist/agents/agents/package-agent.jsdist/agent-sdk/src/register.js

Decision evidence

public snapshot

AI called this Suspicious at 89.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

`dist/index.js` runs plugin auto-discovery whenever the CLI starts.
`dist/plugins/agent-plugin.js` creates and imports `.js` modules from `~/.buff/plugins` and `~/.buff/agents`.
`dist/agents/agents/runner.js` executes task- or LLM-derived shell commands on the host when Docker is unavailable.
`dist/agents/agents/tester.js` runs `npm install` and project tests in a generated sandbox.
`dist/agents/agents/package-agent.js` can modify a target project package manifest and run `npm publish` for a publish task.

Evidence against

`package.json` has no `preinstall`, `install`, or `postinstall` hook.
All reviewed write, install, publish, and shell paths require CLI/agent task execution; none run on package installation or import.
Plugin directories are package-owned `~/.buff/*`, not foreign AI-agent control surfaces.
Provider HTTP clients use configured API keys for named inference services; no credential harvesting or unrelated exfiltration was found.
No reviewed source used `eval`, `Function`, VM execution, native loading, destructive deletion, or stealth persistence.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedProtestwareTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 94 file(s), 1.39 MB of source, external domains: aistudio.google.com, api.github.com, api.groq.com, build.nvidia.com, console.groq.com, docs.docker.com, fb.me, generativelanguage.googleapis.com, github.com, huggingface.co, integrate.api.nvidia.com, jsonplaceholder.typicode.com, openrouter.ai, python.org, raw.githubusercontent.com, reactjs.org, www.google.com, www.w3.org

Source & flagged code

10 flagged

README.mdView file

Lines 99-139markdown

100NVIDIA NIM provides hosted API access to a wide catalog of models (121+ models).

101

1021. Sign up at **[build.nvidia.com](https://build.nvidia.com)** (free tier with rate limits)

1032. Generate an API key from the **Get API Key** button

1043. Copy your key (starts with `nvapi-`)

105

106```bash

107export NVIDIA_NIM_API_KEY="nvapi-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"

108```

109

110### 🔷 Google Gemini

111

112Google's Gemini API has a generous free tier with competitive models.

113

1141. Visit **[aistudio.google.com/apikey](https://aistudio.google.com/apikey)** and click **Create API Key**

1152. Select your Google Cloud project or create one

1163. Copy your key (starts with `AIzaSy`)

117

118```bash

119export GEMINI_API_KEY="AIzaSyxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"

High

High Secret

Package contains a high-severity secret pattern.

README.mdView on unpkg · L119

120```

121

122### 🟣 OpenRouter

123

124OpenRouter gives you access to 200+ models from OpenAI, Anthropic, Google, Meta, and more — all through one API.

125

1261. Sign up at **[openrouter.ai/keys](https://openrouter.ai/keys)** (free credits on sign-up)

1272. Click **Create Key**

1283. Copy your key (starts with `sk-or-v1-`)

129

130```bash

131export OPENROUTER_API_KEY="sk-or-v1-xxxxxxxxxxxxxxxxxxxxxxxxxxxx"

132```

133

134---

135

136## Configuration

137

138### Config File

139

119patternName = google_api_key severity = high line = 119 matchedText = export G...xxx"

High

Secret Pattern

Google API key in README.md

README.mdView on unpkg · L119

211patternName = google_api_key severity = high line = 211 matchedText = GEMINI_A...xxxx

High

Secret Pattern

Google API key in README.md

README.mdView on unpkg · L211

dist/memory/embedder.jsView file

Lines 1-35javascript

1/**

2 * Embedder — Generates vector embeddings from text using a tiered approach.

3 *

4 * Embedding Tier Strategy:

5 * Tier 1: @huggingface/transformers (fast, local, 384-dim) — DEFAULT

6 * Tier 2: Python sentence-transformers via subprocess

7 * Tier 3: LLM-based (any configured InferenceProvider) — FALLBACK

8 *

9 * The embedder auto-selects the best available tier, caches results to avoid

10 * redundant computation, and gracefully degrades when tiers are unavailable.

11 *

dist/agents/agents/runner.jsView file

Lines 182-222javascript

182 /**

183 * Execute a command directly on the host machine.

184 */

185 async executeOnHost(context, command) {

186 if (context.metadata.verboseLogging) {

187 logger.info(` Running: ${command}`);

188 }

189 const timeoutMs

dist/plugins/agent-plugin.jsView file

Lines 39-79javascript

39}

40// ─── Auto-Discovery ─────────────────────────────────────────────────────────

41/**

42 * Scan ~/.buff/plugins/ for provider plugin .js files and register them

43 * with the global PluginRegistry.

44 *

45 * Each file must export a default object matching the ProviderPlugin interface

46 * from ./registry.js. Upon discovery, the plugin is automatically registered

47 * so it can be used with: buff chat --provider <plugin-type>

48 *

49 * Returns the number of successfully loaded provider plugins.

dist/agents/agents/package-agent.jsView file

Lines 1-36javascript

1/**

2 * PackageAgent — Manages npm package operations for the publishing pipeline.

3 *

4 * Capabilities:

5 * - Bump version (patch, minor, major)

6 * - Build project

7 * - Generate changelog from git log

8 * - Publish to npm

9 *

10 * Usage in task plans:

11 * ```json

12 * { "id": "step-publish", "description": "Bump version and publish to npm", "agentType": "package", "dependsOn": ["step-test"] }

dist/agents/agents/tester.jsView file

Lines 276-316javascript

276 * Apply the file changes from the execution context to the sandbox.

277 */

278 applyChangesToSandbox(sandboxPath, changes) {

279 for (const change of changes) {

280 if (change.status === 'deleted')

281 continue;

Source & flagged code

10 flagged · loading source

README.mdView file

119patternName = google_api_key severity = high line = 119 matchedText = export G...xxx"

High

High Secret

Package contains a high-severity secret pattern.

README.mdView on unpkg · L119

119patternName = google_api_key severity = high line = 119 matchedText = export G...xxx"

High

Secret Pattern

Google API key in README.md

README.mdView on unpkg · L119

211patternName = google_api_key severity = high line = 211 matchedText = GEMINI_A...xxxx

High

Secret Pattern

Google API key in README.md

README.mdView on unpkg · L211

dist/memory/embedder.jsView file

15import { createHash } from 'node:crypto'; L16: import { spawn } from 'node:child_process'; L17: import { logger } from '../utils/logger.js';

High

Child Process

Package source references child process execution.

dist/memory/embedder.jsView on unpkg · L15

15import { createHash } from 'node:crypto'; L16: import { spawn } from 'node:child_process'; L17: import { logger } from '../utils/logger.js'; ... L222: let errorOutput = ''; L223: python.stdout?.on('data', (chunk) => { L224: output += chunk.toString(); ... L241: try { L242: const parsed = JSON.parse(output); L243: if (parsed.error) {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/memory/embedder.jsView on unpkg · L15

dist/agents/agents/runner.jsView file

202encoding: 'utf-8', L203: shell: platform() === 'win32' ? (process.env.COMSPEC || 'cmd.exe') : '/bin/sh', L204: maxBuffer: 1024 * 1024,

High

Shell

Package source references shell execution.

dist/agents/agents/runner.jsView on unpkg · L202

dist/plugins/agent-plugin.jsView file

59// Dynamic import for ESM compatibility L60: const mod = await import(pluginPath); L61: if (!mod.default || !mod.default.metadata || !mod.default.getProviderType) {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/plugins/agent-plugin.jsView on unpkg · L59

dist/agents/agents/package-agent.jsView file

16import { join } from 'node:path'; L17: import { execSync } from 'node:child_process'; L18: import { Agent } from '../agent.js'; ... L43: name = 'Package'; L44: description = 'Manages package version, build, and npm publish'; L45: async execute(context, callLLM) { ... L87: async bumpVersion(context, description) { L88: const pkgPath = join(context.workingDirectory, 'package.json'); L89: if (!existsSync(pkgPath)) { ... L91: } L92: const pkg = JSON.parse(readFileSync(pkgPath, 'utf-8')); L93: const currentVersion = pkg.version || '0.0.0';

Critical

Npm Publish Worm

Source mutates package metadata and republishes itself to npm.

dist/agents/agents/package-agent.jsView on unpkg · L16

16Trigger-reachable chain: manifest.main -> dist/index.js -> dist/agents/orchestrator.js -> dist/agents/agents/package-agent.js L16: import { join } from 'node:path'; L17: import { execSync } from 'node:child_process'; L18: import { Agent } from '../agent.js'; ... L43: name = 'Package'; L44: description = 'Manages package version, build, and npm publish'; L45: async execute(context, callLLM) { ... L87: async bumpVersion(context, description) { L88: const pkgPath = join(context.workingDirectory, 'package.json'); L89: if (!existsSync(pkgPath)) { ... L91: } L92: const pkg = JSON.parse(readFileSync(pkgPath, 'utf-8')); L93: const currentVersion = pkg.version || '0.0.0';

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/agents/agents/package-agent.jsView on unpkg · L16

dist/agents/agents/tester.jsView file

296try { L297: return execSync('npm install --prefer-offline --no-audit --no-fund 2>&1', { L298: cwd: sandboxPath,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/agents/agents/tester.jsView on unpkg · L296

Findings

2 Critical6 High5 Medium6 Low

CriticalNpm Publish Wormdist/agents/agents/package-agent.js

CriticalTrigger Reachable Dangerous Capabilitydist/agents/agents/package-agent.js

HighHigh SecretREADME.md

HighChild Processdist/memory/embedder.js

HighShelldist/agents/agents/runner.js

HighRuntime Package Installdist/agents/agents/tester.js

HighSecret PatternREADME.md

MediumDynamic Requiredist/plugins/agent-plugin.js

MediumNetwork

MediumEnvironment Vars

MediumProtestware

MediumStructural Risk Force Deep Review

LowScripts Present

LowWeak Cryptodist/memory/embedder.js

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

89%Warn

Verdict confidence

IntentDangerous Capability

TypeAgent extension lifecycle risk

False-positive riskMedium

Review stagesource_first_review

Firewall policyWarn-only agent extension risk

Package metadata

npm

AuthorDheeraj Sharma

Maintainersimdheerajsharma

Version1.14.1

PublishedJul 16, 2026

LicenseMIT

Dependencies6

Integrityverified

Package size1.09 MB

Files379

Keywordsaiclillmcode-generationmulti-agentollamagroqgemini

LinksRepository Homepage Issues

Runtime surface

package.json

Entrypointsmain → dist/index.jstypes → dist/index.d.tsbin → agent-nuvira

Runtimenode >=21.7.0

Artifact4.66 MB · 379 files1 signature(s)

Install lifecycleNo install hooks · other: build, build:dashboard, build:sdk, dev +5

Behavioral surface

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellHighEntropyStringsMinifiedProtestwareTelemetryUrlStringsManifest: clean

Source & flagged code

10 flagged

README.mdView file

Lines 99-139markdown

100NVIDIA NIM provides hosted API access to a wide catalog of models (121+ models).

101

1021. Sign up at **[build.nvidia.com](https://build.nvidia.com)** (free tier with rate limits)

1032. Generate an API key from the **Get API Key** button

1043. Copy your key (starts with `nvapi-`)

105

106```bash

107export NVIDIA_NIM_API_KEY="nvapi-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"

108```

109

110### 🔷 Google Gemini

111

112Google's Gemini API has a generous free tier with competitive models.

113

1141. Visit **[aistudio.google.com/apikey](https://aistudio.google.com/apikey)** and click **Create API Key**

1152. Select your Google Cloud project or create one

1163. Copy your key (starts with `AIzaSy`)

117

118```bash

119export GEMINI_API_KEY="AIzaSyxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"

High

High Secret

Package contains a high-severity secret pattern.

README.mdView on unpkg · L119

120```

121

122### 🟣 OpenRouter

123

124OpenRouter gives you access to 200+ models from OpenAI, Anthropic, Google, Meta, and more — all through one API.

125

1261. Sign up at **[openrouter.ai/keys](https://openrouter.ai/keys)** (free credits on sign-up)

1272. Click **Create Key**

1283. Copy your key (starts with `sk-or-v1-`)

129

130```bash

131export OPENROUTER_API_KEY="sk-or-v1-xxxxxxxxxxxxxxxxxxxxxxxxxxxx"

132```

133

134---

135

136## Configuration

137

138### Config File

139

119patternName = google_api_key severity = high line = 119 matchedText = export G...xxx"

High

Secret Pattern

Google API key in README.md

README.mdView on unpkg · L119

211patternName = google_api_key severity = high line = 211 matchedText = GEMINI_A...xxxx

High

Secret Pattern

Google API key in README.md

README.mdView on unpkg · L211

dist/memory/embedder.jsView file

Lines 1-35javascript

1/**

2 * Embedder — Generates vector embeddings from text using a tiered approach.

3 *

4 * Embedding Tier Strategy:

5 * Tier 1: @huggingface/transformers (fast, local, 384-dim) — DEFAULT

6 * Tier 2: Python sentence-transformers via subprocess

7 * Tier 3: LLM-based (any configured InferenceProvider) — FALLBACK

8 *

9 * The embedder auto-selects the best available tier, caches results to avoid

10 * redundant computation, and gracefully degrades when tiers are unavailable.

11 *

dist/agents/agents/runner.jsView file

Lines 182-222javascript

182 /**

183 * Execute a command directly on the host machine.

184 */

185 async executeOnHost(context, command) {

186 if (context.metadata.verboseLogging) {

187 logger.info(` Running: ${command}`);

188 }

189 const timeoutMs

dist/plugins/agent-plugin.jsView file

Lines 39-79javascript

39}

41/**

42 * Scan ~/.buff/plugins/ for provider plugin .js files and register them

43 * with the global PluginRegistry.

44 *

45 * Each file must export a default object matching the ProviderPlugin interface

46 * from ./registry.js. Upon discovery, the plugin is automatically registered

47 * so it can be used with: buff chat --provider <plugin-type>

48 *

49 * Returns the number of successfully loaded provider plugins.

dist/agents/agents/package-agent.jsView file

Lines 1-36javascript

1/**

2 * PackageAgent — Manages npm package operations for the publishing pipeline.

3 *

4 * Capabilities:

5 * - Bump version (patch, minor, major)

6 * - Build project

7 * - Generate changelog from git log

8 * - Publish to npm

9 *

10 * Usage in task plans:

11 * ```json

12 * { "id": "step-publish", "description": "Bump version and publish to npm", "agentType": "package", "dependsOn": ["step-test"] }

dist/agents/agents/tester.jsView file

Lines 276-316javascript

276 * Apply the file changes from the execution context to the sandbox.

277 */

278 applyChangesToSandbox(sandboxPath, changes) {

279 for (const change of changes) {

280 if (change.status === 'deleted')

281 continue;