agentiqa@1.1.76
AI-powered testing for web and mobile apps
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe automatic hook is a Node-version gate, but the CLI contains an unjustified package-external secret lookup and remote credential-forwarding capability. The behavior is user-triggered and lacks a proven attacker endpoint, so warning is more proportionate than blocking.
Static reason
One or more suspicious static signals were detected.
Trigger
Running the CLI's embedded agent flow without a configured key or authenticated managed-key source.
Impact
A key stored outside the package may be used without the owner explicitly supplying it to this CLI; prompted credentials may leave the local process.
Mechanism
External .env key harvesting and remote agent credential forwarding.
AI rationale
The automatic hook is a Node-version gate, but the CLI contains an unjustified package-external secret lookup and remote credential-forwarding capability. The behavior is user-triggered and lacks a proven attacker endpoint, so warning is more proportionate than blocking.
Evidence
dist/cli.js../../../execution-engine/.env../../execution-engine/.env
Decision evidence
public snapshotAI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The package has an automatic preinstall hook.
- The CLI searches outside its package directory for an execution-engine .env file and extracts GEMINI_API_KEY.
- During an interactive agent session, entered credentials are sent to the remote session handler.
Evidence against
- The preinstall script only rejects unsupported Node versions and does not modify files or make network requests.
- The external key lookup is reached only during a user-invoked CLI flow when normal authentication and environment-key options are unavailable.
- No self-dependency, install-time payload download, or foreign AI-agent control-surface mutation was found.
Behavioral surface
EnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
NoLicense
Source & flagged code
8 flaggedpackage.jsonView file
•scripts.preinstall = node scripts/preinstall.cjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.preinstall = node scripts/preinstall.cjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/cli.jsView file
1#!/usr/bin/env node
L2: var dV=Object.create;var xS=Object.defineProperty;var uV=Object.getOwnPropertyDescriptor;var pV=Object.getOwnPropertyNames;var hV=Object.getPrototypeOf,fV=Object.prototype.hasOwnPr...
L3: ${n.message}`),r?new L6.VercelOidcTokenError(r):n}return t}function oy(){let t=(0,P6.getContext)().headers?.["x-vercel-oidc-token"]??process.env.VERCEL_OIDC_TOKEN;if(!t)throw new E...
...
L5: `)+`
L6: `}var yV=new Set(["hint","known-issue","credential"]);function bV(t=Ym){let e=new Set,n=new Set,r=a=>{e.add(a.flag),a.arg&&n.add(a.flag)};for(let a of t.commands)for(let i of a.fla...
L7: `);for(let[n,r]of UV)if(n.test(e))return r}function KS(t){let e=t.map(s=>s.text).join(`
Findings
7 High4 Medium5 Low
HighInstall Time Lifecycle Scriptspackage.json
HighSame File Env Network Executiondist/cli.js
HighCredential Redirect Persistencedist/cli.js
HighCommand Output Exfiltrationdist/cli.js
HighRemote Agent Bridgedist/cli.js
HighTrigger Reachable Command Output Exfiltrationdist/cli.js
HighSemantic Analysis Limiteddist/cli.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to agentiqa@1.1.76.
See all versions of agentiqa for other recorded verdicts.
- Review the evidence and your use of agentiqa@1.1.76 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.