agentiqa@1.1.83
AI-powered testing for web and mobile apps
AI Security Review
scanned 22d ago · by lpm-firewall-aiThe preinstall hook is limited to a Node-version check, and the observed command execution is tied to conditional test tooling setup. The inspected API-key paths show configured service selection and entitlement checks; no unrelated recipient or unconsented disclosure was confirmed.
Static reason
One or more suspicious static signals were detected.
Trigger
Package installation runs the Node-version check; browser or mobile setup is reached through a CLI test operation.
Impact
No unconsented credential disclosure, consumer-project mutation, or malicious install behavior was established.
Mechanism
The hook exits for Node versions below 18. Browser setup installs Chromium only after a missing-browser check, and mobile setup installs its helper only when the helper cannot be resolved.
AI rationale
The preinstall hook is limited to a Node-version check, and the observed command execution is tied to conditional test tooling setup. The inspected API-key paths show configured service selection and entitlement checks; no unrelated recipient or unconsented disclosure was confirmed.
Evidence
package.jsonscripts/preinstall.cjsdist/cli.js
Decision evidence
public snapshotAI called this Clean at 88.0% confidence as Benign with high false-positive risk.
Evidence for AI clean decision
- The manifest exposes the CLI from dist/cli.js and runs scripts/preinstall.cjs as its preinstall hook.
- The preinstall hook checks the Node major version and exits only when it is below 18.
- The CLI selects its control-plane base from AGENTIQA_API_URL, a stored service binding, or its service default.
- The test path reaches browser or mobile setup; Chromium installation follows a missing-browser check, and mobile helper installation follows a missing-package check.
- The CLI removes provider keys from the embedded engine environment when entitlement is absent and reports that they are not forwarded.
- The inspected test path passes selected provider keys to embedded engine startup.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsMinifiedPossibleObfuscation
Source & flagged code
9 flaggedpackage.jsonView file
•scripts.preinstall = node scripts/preinstall.cjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.preinstall = node scripts/preinstall.cjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/cli.jsView file
5`)+`
L6: `}var WH=new Set(["hint","known-issue","credential"]);function zH(t=jg){let e=new Set,n=new Set,r=a=>{e.add(a.flag),a.arg&&n.add(a.flag)};for(let a of t.commands)for(let i of a.fla...
L7: Error message: ${ba(e)}`,cause:e}),this[LT]=!0,this.text=t}static isInstance(t){return Me.hasMarker(t,dR)}},uR="AI_LoadAPIKeyError",pR=`vercel.ai.error.${uR}`,nq=Symbol.for(pR),MT,...
High
Child Process
Package source references child process execution.
Findings
9 High4 Medium6 Low
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/cli.js
HighShell
HighSame File Env Network Executiondist/cli.js
HighCredential Redirect Persistencedist/cli.js
HighCommand Output Exfiltrationdist/cli.js
HighRemote Agent Bridgedist/cli.js
HighTrigger Reachable Command Output Exfiltrationdist/cli.js
HighSemantic Analysis Limiteddist/cli.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
Affected versions and remediation
This report applies to agentiqa@1.1.83.
See all versions of agentiqa for other recorded verdicts.
- Review the evidence and your use of agentiqa@1.1.83 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.