registry / agenthub-ai / 1.6.2
agenthub-ai@1.6.2
AgentHub Agent - mobile remote control for agents
AI Security Review
scanned 27d ago · by lpm-firewall-aiInstall does not run package code, and the published entry only connects to the vendor agent websocket when the user launches the CLI. Remote session and file control match that paired-agent product and stay behind the default file sandbox.
Static reason
One or more suspicious static signals were detected.
Trigger
The user runs the agenthub bin or an explicit install, update, or uninstall argument.
Impact
No unconsented install mutation, credential theft, or foreign agent-config write was identified. Remote control applies only after the user starts and pairs the agent.
Mechanism
The process connects to the vendor websocket, registers a local pairing token, and handles remote Claude session and sandboxed file commands.
AI rationale
Install does not run package code, and the published entry only connects to the vendor agent websocket when the user launches the CLI. Remote session and file control match that paired-agent product and stay behind the default file sandbox.
Decision evidence
public snapshotAI called this Clean at 82.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json only publishes a user-run bin named agenthub; its scripts are dev, build, test, and prepublishOnly, with no preinstall, install, or postinstall hook.
- The published bundle forces the websocket to the vendor host wss://agenthub-agent.fyenet.com and does not honor a custom SERVER_URL.
- Remote file writes start with the file sandbox enabled and request permission before writing.
- Autostart service install and the default agent loop run only when the CLI argv selects them.
Evidence against
- After the user pairs, the vendor socket can create Claude sessions and write files under the sandbox.
- The update subcommand runs npm install -g of a chosen agenthub-ai version.
Behavioral surface
ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
8 flagged · loading sourcedist-publish/main.jsView file
49and subsequent starts auto-reconnect; on token invalidation (app unbind/delete) the local
L50: token is cleared and the agent exits.`,pairingCode:"[AgentHubAgent] pairing code: {{code}}",pairingExpires:"[AgentHubAgent] expires at {{time}}, waiting for app input...",pairingQr...
L51: `);o>0&&c.shift();for(let l=c.length-1;l>=0;l--){let u=c[l];if(!u)continue;let g=u.match(/"cwd"\s*:\s*"((?:[^"\\]|\\.)*)"/);if(!g)continue;let m;try{m=JSON.parse(`"${g[1]}"`)}catch...
High
Child Process
Package source references child process execution.
dist-publish/main.jsView on unpkg · L4949and subsequent starts auto-reconnect; on token invalidation (app unbind/delete) the local
L50: token is cleared and the agent exits.`,pairingCode:"[AgentHubAgent] pairing code: {{code}}",pairingExpires:"[AgentHubAgent] expires at {{time}}, waiting for app input...",pairingQr...
L51: `);o>0&&c.shift();for(let l=c.length-1;l>=0;l--){let u=c[l];if(!u)continue;let g=u.match(/"cwd"\s*:\s*"((?:[^"\\]|\\.)*)"/);if(!g)continue;let m;try{m=JSON.parse(`"${g[1]}"`)}catch...
High
49and subsequent starts auto-reconnect; on token invalidation (app unbind/delete) the local
L50: token is cleared and the agent exits.`,pairingCode:"[AgentHubAgent] pairing code: {{code}}",pairingExpires:"[AgentHubAgent] expires at {{time}}, waiting for app input...",pairingQr...
L51: `);o>0&&c.shift();for(let l=c.length-1;l>=0;l--){let u=c[l];if(!u)continue;let g=u.match(/"cwd"\s*:\s*"((?:[^"\\]|\\.)*)"/);if(!g)continue;let m;try{m=JSON.parse(`"${g[1]}"`)}catch...
Findings
6 High5 Medium5 Low
HighChild Processdist-publish/main.js
HighShelldist-publish/main.js
HighSame File Env Network Executiondist-publish/main.js
HighCommand Output Exfiltrationdist-publish/main.js
HighTrigger Reachable Command Output Exfiltrationdist-publish/main.js
HighTrigger Reachable Persistencedist-publish/main.js
MediumDynamic Requiredist-publish/main.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist-publish/main.js
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
Low
Affected versions and remediation
This report applies to agenthub-ai@1.6.2.
See all versions of agenthub-ai for other recorded verdicts.
- Review the evidence and your use of agenthub-ai@1.6.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.