agent-qa@0.2.3
⚠ Under reviewThe self-improving Agentic QA harness with Memory
AI Security Review
scanned 11d ago · by lpm-firewall-aiThe static hints for shell execution and runtime installation are consistent with explicit CLI features such as browser installation. However, the CLI calls a first-party agent dependency whose source is unavailable, leaving a material runtime path unresolved; manual review is appropriate without inferring an attack.
Static reason
One or more suspicious static signals were detected.
Trigger
Use of the CLI paths that invoke the first-party agent dependency.
Impact
The dependency’s effects cannot be determined from this snapshot; no specific harmful effect is established.
Mechanism
The CLI delegates agent invocation to a declared dependency whose implementation could not be inspected here.
AI rationale
The static hints for shell execution and runtime installation are consistent with explicit CLI features such as browser installation. However, the CLI calls a first-party agent dependency whose source is unavailable, leaving a material runtime path unresolved; manual review is appropriate without inferring an attack.
Evidence
package.jsondist/cli-main.js
Decision evidence
public snapshotAI called this Manual Review at 78.0% confidence as Unknown with medium false-positive risk.
AI review observations
- package.json declares multiple first-party runtime dependencies whose source is unavailable in this snapshot.
- The CLI imports an agent invocation function from one of those dependencies, so its behavior is part of the package’s runtime path.
- The flagged browser installer launches the package’s own installer with selected browser arguments.
Evidence against
- The inspected browser-install code forwards explicit selection arguments to the package’s installer; this does not establish hidden payload execution.
- The manifest exposes a CLI entry point and runtime API exports, but the inspected sources do not establish a concrete attack.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
5 flaggeddist/cli-main.jsView file
8744import { randomUUID as randomUUID6 } from "crypto";
L8745: import { spawnSync } from "child_process";
L8746: import {
High
Child Process
Package source references child process execution.
dist/cli-main.jsView on unpkg · L874424197// Do not inherit `--input-type=module` or test loaders that would reinterpret eval as ESM.
L24198: execArgv: [],
L24199: name: "agent-qa-writer-lease-heartbeat",
High
33"use strict";
L34: RE_INITIALIZE_URL = "https://vostride.com/docs/agent-qa/migrate/v0-1-to-v0-2";
L35: HARD_CUT_STEPS = [
...
L157: for (const [envKey, configPath] of Object.entries(ENV_MAPPING)) {
L158: const value = process.env[envKey];
L159: if (value !== void 0) {
...
L702: try {
L703: parsed = JSON.parse(bodySeed);
L704: } catch {
...
L1287: summary: bundle.summary,
L1288: body: bundle.body,
L1289: distilledEvidenceRef: {
High
Hidden Inline Dependency Execution
Source silently spawns a Node process to execute an inline dependency payload.
dist/cli-main.jsView on unpkg · L33Findings
4 High4 Medium4 Low
HighChild Processdist/cli-main.js
HighShelldist/cli-main.js
HighHidden Inline Dependency Executiondist/cli-main.js
HighRuntime Package Installdist/cli-main.js
MediumDynamic Requiredist/index.cjs
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to agent-qa@0.2.3.
See all versions of agent-qa for other recorded verdicts.
- Review the evidence and your use of agent-qa@0.2.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.