registry / agenthub-ai / 1.7.0
agenthub-ai@1.7.0
AgentHub Agent - mobile remote control for agents
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package has dangerous remote AI-agent control capabilities, including a remotely disableable file sandbox, but they are the disclosed product function and require explicit runtime use. It is not malicious under the install-time blocking boundary.
Static reason
One or more suspicious static signals were detected.
Trigger
User runs agenthub and pairs it; persistence requires agenthub install.
Impact
A compromised or authorized remote control channel could operate the local AI agent and request filesystem actions.
Mechanism
Remote WebSocket control of Claude sessions and file operations.
AI rationale
The package has dangerous remote AI-agent control capabilities, including a remotely disableable file sandbox, but they are the disclosed product function and require explicit runtime use. It is not malicious under the install-time blocking boundary.
Evidence
package.jsondist-publish/main.jsREADME_EN.md~/.agenthub/agent-token-<kind>.json~/.claude/projects
Network endpoints3
wss://agenthub-agent.fyenet.comws://localhost:8787/agentws://10.168.1.10:8787/agent
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- Remote runtime connects to AgentHub’s production WebSocket.
- Claude sessions are launched with bypassPermissions.
- Remote settings can disable the file-operation sandbox.
- The explicit install command creates an auto-start service.
Evidence against
- package.json has no preinstall, install, or postinstall hook.
- Persistence is reached only through the explicit agenthub install command.
- File reads and writes request remote approval while the sandbox is enabled by default.
- No hidden endpoint, credential harvesting, or payload download was confirmed.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
6 flagged · loading sourcedist-publish/main.jsView file
49and subsequent starts auto-reconnect; on token invalidation (app unbind/delete) the local
L50: token is cleared and the agent exits.`,pairingCode:"[AgentHubAgent] pairing code: {{code}}",pairingExpires:"[AgentHubAgent] expires at {{time}}, waiting for app input...",pairingQr...
L51: `);o>0&&c.shift();for(let l=c.length-1;l>=0;l--){let u=c[l];if(!u)continue;let p=u.match(/"cwd"\s*:\s*"((?:[^"\\]|\\.)*)"/);if(!p)continue;let m;try{m=JSON.parse(`"${p[1]}"`)}catch...
High
Child Process
Package source references child process execution.
dist-publish/main.jsView on unpkg · L4949and subsequent starts auto-reconnect; on token invalidation (app unbind/delete) the local
L50: token is cleared and the agent exits.`,pairingCode:"[AgentHubAgent] pairing code: {{code}}",pairingExpires:"[AgentHubAgent] expires at {{time}}, waiting for app input...",pairingQr...
L51: `);o>0&&c.shift();for(let l=c.length-1;l>=0;l--){let u=c[l];if(!u)continue;let p=u.match(/"cwd"\s*:\s*"((?:[^"\\]|\\.)*)"/);if(!p)continue;let m;try{m=JSON.parse(`"${p[1]}"`)}catch...
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist-publish/main.jsView on unpkg · L4949and subsequent starts auto-reconnect; on token invalidation (app unbind/delete) the local
L50: token is cleared and the agent exits.`,pairingCode:"[AgentHubAgent] pairing code: {{code}}",pairingExpires:"[AgentHubAgent] expires at {{time}}, waiting for app input...",pairingQr...
L51: `);o>0&&c.shift();for(let l=c.length-1;l>=0;l--){let u=c[l];if(!u)continue;let p=u.match(/"cwd"\s*:\s*"((?:[^"\\]|\\.)*)"/);if(!p)continue;let m;try{m=JSON.parse(`"${p[1]}"`)}catch...
Findings
5 High4 Medium5 Low
HighChild Processdist-publish/main.js
HighSame File Env Network Executiondist-publish/main.js
HighCommand Output Exfiltrationdist-publish/main.js
HighTrigger Reachable Command Output Exfiltrationdist-publish/main.js
HighTrigger Reachable Persistencedist-publish/main.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist-publish/main.js
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to agenthub-ai@1.7.0.
See all versions of agenthub-ai for other recorded verdicts.
- Review the evidence and your use of agenthub-ai@1.7.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.