agentiqa@1.1.93
AI-powered testing for web and mobile apps
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe CLI sends runtime telemetry by default that includes the user's test-target domain and source-tool category, without an in-context disclosure. This is a privacy risk warranting a warning; the reviewed source does not establish credential theft or unrelated command execution.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Invoking the CLI; test commands also emit events when a run starts.
Impact
Agentiqa receives metadata about the user's test target and tool category without an in-context disclosure.
Mechanism
The CLI posts events containing the target domain and source-tool category to `${Vt()}/api/t`, defaulting to https://agentiqa.com/api/t. Failed events are queued locally for later delivery.
AI rationale
The CLI sends runtime telemetry by default that includes the user's test-target domain and source-tool category, without an in-context disclosure. This is a privacy risk warranting a warning; the reviewed source does not establish credential theft or unrelated command execution.
Evidence
dist/cli.js~/.agentiqa/analytics.json~/.agentiqa/events-queue.ndjson~/.agentiqa/.installed
Network endpoints2
agentiqa.com/api/tAGENTIQA_ANALYTICS_ENDPOINT (optional override)
Decision evidence
public snapshotAI called this Suspicious at 93.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- At test start, the CLI records the target domain and source-tool category in telemetry events.
- The CLI posts telemetry to its configured analytics endpoint, defaulting to the Agentiqa control plane, and retries failed events from a local queue.
- Telemetry runs by default; the CLI provides environment-variable and config-file opt-outs, but the package gives no disclosure alongside these calls.
Evidence against
- The preinstall hook only checks the Node.js version and exits on versions below 18.
- The CLI’s provider-key selection and credential handling are consistent with its documented model-provider and account-authentication functions.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsMinifiedPossibleObfuscationTelemetry
Source & flagged code
13 flaggedpackage.jsonView file
•scripts.preinstall = node scripts/preinstall.cjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.preinstall = node scripts/preinstall.cjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/cli.jsView file
2425L2426: Return a verdict for EVERY item, each with its 0-based "index", a "relation" ("cosmetic" or "critical"), and a one-line "reason".`}function Pre(t,e){return t.map(()=>({relation:"cr...
L2427: `}function Zre(t,e,n={}){if(!t||e!=="text")return 0;let r=n.writeStderr??(o=>{process.stderr.write(o)}),s=n.onExit??(o=>{process.once("exit",o)}),i=U4e(t);return r(i),s(()=>r(i)),1...
L2428: `)}function Ut(t,e,n){process.stdout.write(JSON.stringify({ok:!1,schemaVersion:nse,error:{code:t,message:e},...n??{},...rse()})+`
L2429: `)}import{createServer as qQe}from"node:net";import{createRequire as WQe}from"node:module";import{appendFileSync as KQe}from"node:fs";import{inspect as zQe}from"node:util";import N...
L2430: `).join(""),g,p].join(`
Findings
3 Critical10 High4 Medium6 Low
CriticalSame File Env Network Executiondist/cli.js
CriticalCredential Exfiltrationdist/cli.js
CriticalTrigger Reachable Dangerous Capabilitydist/cli.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/cli.js
HighShell
HighEvaldist/cli.js
HighCredential Redirect Persistencedist/cli.js
HighCommand Output Exfiltrationdist/cli.js
HighRemote Agent Bridgedist/cli.js
HighTrigger Reachable Credential Exfiltrationdist/cli.js
HighTrigger Reachable Command Output Exfiltrationdist/cli.js
Affected versions and remediation
This report applies to agentiqa@1.1.93.
See all versions of agentiqa for other recorded verdicts.
- Review the evidence and your use of agentiqa@1.1.93 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.