agenthub-ai@1.3.1
此版本已过时，请升级到最新的 agenthub-ai（npm install -g agenthub-ai）
AgentHub Agent - mobile remote control for agents
AI Security Review
scanned 2mo ago · by lpm-firewall-aiNo source evidence shows covert installation-time behavior or a deceptive payload; the risky remote-control capability is implemented and documented as the product. It remains a dangerous AI-agent control capability that warrants a warning rather than a block.
Static reason
One or more suspicious static signals were detected.
Trigger
User runs agenthub and completes pairing; user runs agenthub install for persistence.
Impact
A paired remote account can control supported agent sessions and access the configured work area; persistence is user-command initiated.
Mechanism
WebSocket-controlled Claude agent bridge with optional OS service installation.
AI rationale
No source evidence shows covert installation-time behavior or a deceptive payload; the risky remote-control capability is implemented and documented as the product. It remains a dangerous AI-agent control capability that warrants a warning rather than a block.
Evidence
package.jsondist-publish/main.jsREADME_EN.md~/.claude/projects~/.agenthub/agent-token-prod.json/etc/systemd/system/agenthub.service/Library/LaunchDaemons/com.agenthub.agenthub.plist
Network endpoints1
wss://agenthub-agent.fyenet.com
Decision evidence
public snapshotAI called this Suspicious at 93.0% confidence as Benign with low false-positive risk.
Evidence for warning
- Runs Claude SDK sessions with bypassPermissions.
- Connects to AgentHub's production WebSocket and sends JSON events.
- Watches Claude project session files and forwards history to the transport.
- Explicit install command creates OS auto-start persistence.
Evidence against
- No preinstall, install, or postinstall lifecycle hook; only prepublishOnly is declared.
- Persistence is dispatched only by the explicit agenthub install command.
- Remote control, pairing, file access, and auto-start are documented package features.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
6 flagged · loading sourcedist-publish/main.jsView file
51and subsequent starts auto-reconnect; on token invalidation (app unbind/delete) the local
L52: token is cleared and the agent exits.`,pairingCode:"[AgentHubAgent] pairing code: {{code}}",pairingExpires:"[AgentHubAgent] expires at {{time}}, waiting for app input...",pairingQr...
L53: `);o>0&&c.shift();for(let l=c.length-1;l>=0;l--){let u=c[l];if(!u)continue;let g=u.match(/"cwd"\s*:\s*"((?:[^"\\]|\\.)*)"/);if(!g)continue;let m;try{m=JSON.parse(`"${g[1]}"`)}catch...
High
Child Process
Package source references child process execution.
dist-publish/main.jsView on unpkg · L5151and subsequent starts auto-reconnect; on token invalidation (app unbind/delete) the local
L52: token is cleared and the agent exits.`,pairingCode:"[AgentHubAgent] pairing code: {{code}}",pairingExpires:"[AgentHubAgent] expires at {{time}}, waiting for app input...",pairingQr...
L53: `);o>0&&c.shift();for(let l=c.length-1;l>=0;l--){let u=c[l];if(!u)continue;let g=u.match(/"cwd"\s*:\s*"((?:[^"\\]|\\.)*)"/);if(!g)continue;let m;try{m=JSON.parse(`"${g[1]}"`)}catch...
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist-publish/main.jsView on unpkg · L5151and subsequent starts auto-reconnect; on token invalidation (app unbind/delete) the local
L52: token is cleared and the agent exits.`,pairingCode:"[AgentHubAgent] pairing code: {{code}}",pairingExpires:"[AgentHubAgent] expires at {{time}}, waiting for app input...",pairingQr...
L53: `);o>0&&c.shift();for(let l=c.length-1;l>=0;l--){let u=c[l];if(!u)continue;let g=u.match(/"cwd"\s*:\s*"((?:[^"\\]|\\.)*)"/);if(!g)continue;let m;try{m=JSON.parse(`"${g[1]}"`)}catch...
Findings
5 High4 Medium5 Low
HighChild Processdist-publish/main.js
HighSame File Env Network Executiondist-publish/main.js
HighCommand Output Exfiltrationdist-publish/main.js
HighTrigger Reachable Command Output Exfiltrationdist-publish/main.js
HighTrigger Reachable Persistencedist-publish/main.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist-publish/main.js
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to agenthub-ai@1.3.1.
See all versions of agenthub-ai for other recorded verdicts.
- Review the evidence and your use of agenthub-ai@1.3.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.