agentiqa@1.1.45
AI-powered testing for web and mobile apps
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThe only install-time code is a Node-version gate. Runtime network, browser, credential, and optional mobile-support behavior is consistent with the documented testing CLI and requires explicit use.
Static reason
One or more suspicious static signals were detected.
Trigger
Explicit agentiqa CLI login, web-test, or mobile-test command.
Impact
Can control the user-selected test target and send authenticated testing data to the Agentiqa service.
Mechanism
User-invoked hosted/local test-engine orchestration.
AI rationale
The only install-time code is a Node-version gate. Runtime network, browser, credential, and optional mobile-support behavior is consistent with the documented testing CLI and requires explicit use.
Evidence
package.jsonscripts/preinstall.cjsdist/cli.js~/.agentiqa/credentials.json
Network endpoints2
agentiqa.comengine.agentiqa.com
Decision evidence
public snapshotAI called this Clean at 92.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- dist/cli.js can globally install mobile MCP support, but only during an invoked mobile run.
Evidence against
- scripts/preinstall.cjs only rejects Node versions below 18.
- No install hook writes agent configs, harvests data, or contacts a network endpoint.
- dist/cli.js network calls support the documented testing/auth service.
- Credential storage is limited to ~/.agentiqa/credentials.json with mode 0600.
- Browser and command capabilities are invoked by explicit CLI testing workflows.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsMinifiedTelemetryUrlStrings
NoLicense
Source & flagged code
7 flaggedpackage.jsonView file
•scripts.preinstall = node scripts/preinstall.cjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.preinstall = node scripts/preinstall.cjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/cli.jsView file
5`)+`
L6: `}import{spawn as wne}from"node:child_process";import{mkdirSync as Sne,writeFileSync as Ene,existsSync as Tne,statSync as Ine}from"node:fs";import{tmpdir as xne}from"node:os";impor...
L7: `);for(let[n,r]of jL)if(n.test(e))return r}function VL(t){let e=t.map(s=>s.text).join(`
High
Findings
6 High4 Medium7 Low
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/cli.js
HighSame File Env Network Executiondist/cli.js
HighCommand Output Exfiltrationdist/cli.js
HighSandbox Evasion Gated Capabilitydist/cli.js
HighRemote Agent Bridgedist/cli.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowEval
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
Affected versions and remediation
This report applies to agentiqa@1.1.45.
See all versions of agentiqa for other recorded verdicts.
- Review the evidence and your use of agentiqa@1.1.45 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.