registry / agentix-cli / 0.131.0

agentix-cli@0.131.0

AI operations layer for small and medium businesses. Routes Telegram, WhatsApp, GitLab, GitHub, crons, webhooks, and mesh tasks to AI agents. Web wizard for operators, CLI for engineers. Self-hosted.

AI Security Review

scanned 14d ago · by lpm-firewall-ai

The daemon automatically writes a package-owned skill into configured Claude workspaces, which meets the warning policy for first-party agent extension setup. The npm postinstall behavior is limited to rebuilding `better-sqlite3` on an ABI mismatch, and the inspected Anthropic credential flow targets Anthropic’s API.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

Starting the daemon with configured agent workspaces.

Impact

The package adds a persistent agent skill that can affect later agent sessions.

Mechanism

The daemon writes `remember.md` under each configured workspace’s `.claude/skills` directory and syncs agent memory there.

AI rationale

Evidence

dist/chunk-L4ZS4HGJ.js.claude/skills/remember.md

Decision evidence

public snapshot

AI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The daemon startup path automatically installs its memory surface into configured agent workspaces.
That setup writes or updates a `remember.md` skill under each workspace’s `.claude/skills` directory.
The postinstall script is gated and limited to rebuilding `better-sqlite3` after detecting an ABI mismatch.
The auth helper reads Claude and OpenClaw credentials, while its Anthropic requests target `api.anthropic.com`.

Evidence against

The package description identifies agent orchestration as its purpose, and the extension is a package-owned memory feature for configured workspaces.

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 215 file(s), 4.99 MB of source, external domains: 100.64.0.11, 100.x.x.x, 127.0.0.1, 192.168.1.50, api.anthropic.com, api.context7.com, api.deepseek.com, api.elevenlabs.io, api.example.com, api.github.com, api.openai.com, api.telegram.org, api.typesafe.ai, claude.ai, console.anthropic.com, docs.anthropic.com, docs.claude.com, example.com, example.org, fonts.googleapis.com, fonts.gstatic.com, github.com, gitlab.com, gitlab.example.com, host.example.ts.net, my-mac.tailnet-name.ts.net, ntfy.sh, opencode.ai, openrouter.ai, peer.example.com, pro.reactflow.dev, raw.githubusercontent.com, reactflow.dev, reactjs.org, status.anthropic.com, t.me, unpkg.com, wacli.sh, www.apple.com, www.w3.org, x.com, x.tld

Source & flagged code

19 flagged

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/program-ZPNEAACQ.jsView file

1import{a as tm,b as Er,g as om}from"./chunk-KIYV4ZHG.js";import{b as em}from"./chunk-WKQQIYOE.js";import{A as Yg,C as ha,D as Vg,F as Xg,a as Cg,e as Jt,f as Ig,g as jg,h as Dg,i a... L2: Computer-use helper \u2192 ${et(i,lr)} ... L5: Starts at login \u2192 ${a.file}${c.map(d=>` L6: Removes duplicate login item \u2192 ${d.file}`).join("")}`),e.dryRun)return;try{Ct("xcrun",["--find","swiftc"],{stdio:"pipe"})}catch{throw new Error("Apple command-line tools are r... L7: Allow Microphone for the app and Accessibility / Screen Recording for the helper when macOS asks.

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

dist/program-ZPNEAACQ.jsView on unpkg · L1

1import{a as tm,b as Er,g as om}from"./chunk-KIYV4ZHG.js";import{b as em}from"./chunk-WKQQIYOE.js";import{A as Yg,C as ha,D as Vg,F as Xg,a as Cg,e as Jt,f as Ig,g as jg,h as Dg,i a... L2: Computer-use helper \u2192 ${et(i,lr)} ... L9: `)),{path:o,changed:l,events:a,guardInstalled:c}}function um(e={}){let t=e.path??hs();if(!Rr(t))return{path:t,changed:!1,events:[],guardInstalled:!1};let o;try{o=JSON.parse(Nr(t,"u... L10: `),{path:t,changed:i,events:r,guardInstalled:!1}}function ys(e=hs()){if(!Rr(e))return!1;try{return!!JSON.parse(Nr(e,"utf-8"))?.hooks?.Stop?.some?.(o=>jr(o,va))}catch{return!1}}var ... L11: `:"")+r.subarray(0,i).toString("utf8")}finally{await t.close()}await fm(e.url,"ended",cd.parse({sessionId:e.session,runId:e.run,transcript:o})),console.log("Run queued for review."...

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

dist/program-ZPNEAACQ.jsView on unpkg · L1

High

Child Process

Package source references child process execution.

dist/program-ZPNEAACQ.jsView on unpkg · L1

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/program-ZPNEAACQ.js: import{a as tm,b as Er,g as om}from"./chunk-KIYV4ZHG.js";import{b as em}from"./chunk-WKQQIYOE.js";import{A as Yg,C as ha,D as Vg,F as Xg,a as Cg,e as Jt,f as Ig,g as jg,h as Dg,i a... The AgentX daemon and a speech transcription backend must also be available. Run agentx desktop status to inspect the login service.`)}finally{rm(g,{recursive:!0,force:!0})}});Sn.c... `),{path:t,changed:i,events:r,guardInstalled:!1}}function ys(e=hs()){if(!Rr(e))return!1;try{return!!JSON.parse(Nr(e,"utf-8"))?.hooks?.Stop?.some?.(o=>jr(o,va))}catch{return!1}}var ... `:"")+r.subarray(0,i).toString("utf8")}finally{await t.close()}aw

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/program-ZPNEAACQ.jsView on unpkg

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: r next login").action(async()=>{tr(),await $a(or().keep),console.log("desktop assistant stopped.")});sn.command("status").description("show the desktop login service status").action(()=>{tr();let{keep:e}=or();try{console.log(ct("launchctl",["print",fs(e)],{encoding:"utf8",stdio:["ignore","pipe","pipe"]}))}catch{console.log(ba(e.file)?"installed, but not running. run agentx desktop start.":"not installed. run agentx desktop install.")}});import{command as vh}from"commander";import{open as xh}from"fs/promises";import{existssync as rr,mkdirsync as jh,readfilesync as nr,writefilesync as lm}from"fs";import{homedir as gh}from"os";import{dirname as hh,resolve as ka}from"path";var va="/attach/",dm="/guard/ch

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/program-ZPNEAACQ.jsView on unpkg

1Cross-file remote execution chain: dist/program-ZPNEAACQ.js spawns dist/board-dashboard-3AI2Z2SP.js; helper contains network access plus dynamic code execution. L1: import{a as tm,b as Er,g as om}from"./chunk-KIYV4ZHG.js";import{b as em}from"./chunk-WKQQIYOE.js";import{A as Yg,C as ha,D as Vg,F as Xg,a as Cg,e as Jt,f as Ig,g as jg,h as Dg,i a... L2: Computer-use helper \u2192 ${et(i,lr)} ... L5: Starts at login \u2192 ${a.file}${c.map(d=>` L6: Removes duplicate login item \u2192 ${d.file}`).join("")}`),e.dryRun)return;try{Ct("xcrun",["--find","swiftc"],{stdio:"pipe"})}catch{throw new Error("Apple command-line tools are r... L7: Allow Microphone for the app and Accessibility / Screen Recording for the helper when macOS asks. L8: The AgentX daemon and a speech transcription backend must als

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/program-ZPNEAACQ.jsView on unpkg · L1

1Trigger-reachable persistence chain: manifest.bin -> dist/cli.js -> dist/program-ZPNEAACQ.js L1: import{a as tm,b as Er,g as om}from"./chunk-KIYV4ZHG.js";import{b as em}from"./chunk-WKQQIYOE.js";import{A as Yg,C as ha,D as Vg,F as Xg,a as Cg,e as Jt,f as Ig,g as jg,h as Dg,i a... L2: Computer-use helper \u2192 ${et(i,lr)} ... L5: Starts at login \u2192 ${a.file}${c.map(d=>` L6: Removes duplicate login item \u2192 ${d.file}`).join("")}`),e.dryRun)return;try{Ct("xcrun",["--find","swiftc"],{stdio:"pipe"})}catch{throw new Error("Apple command-line tools are r... L7: Allow Microphone for the app and Accessibility / Screen Recording for the helper when macOS asks. L8: The AgentX daemon and a speech transcription backend must also be available. Run agentx desktop status to inspect the login servi

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/program-ZPNEAACQ.jsView on unpkg · L1

10`),{path:t,changed:i,events:r,guardInstalled:!1}}function ys(e=hs()){if(!Rr(e))return!1;try{return!!JSON.parse(Nr(e,"utf-8"))?.hooks?.Stop?.some?.(o=>jr(o,va))}catch{return!1}}var ... L11: `:"")+r.subarray(0,i).toString("utf8")}finally{await t.close()}await fm(e.url,"ended",cd.parse({sessionId:e.session,runId:e.run,transcript:o})),console.log("Run queued for review."... L12: `)){let n=o.trim();if(!n||n.startsWith("#"))continue;let s=n.indexOf("=");if(s<0)continue;let r=n.slice(0,s).trim();if(!r||process.env[r]!==void 0)continue;let i=n.slice(s+1).trim(...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/program-ZPNEAACQ.jsView on unpkg · L10

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/program-ZPNEAACQ.jsView on unpkg · L1

dist/board-dashboard-3AI2Z2SP.jsView file

5636package = agentix-cli; repositoryIdentity = agentx; dependency = cronstrue L5636: ${s||"You are "+a+"."} L5637: `)}catch{}return{summary:l}}function tp(t){let e=String(t?.id||"").trim();if(!e)throw new Error("Agent id is required.");let a=t?.patch||{},{summary:n}=C(r=>{if(!r.agents?.[e])thro... L5638: `,"utf-8");try{let s=X().dashboard.daemonUrl?.replace(/\/+$/,"")||"http://127.0.0.1:18800";fetch(`${s}/reload`,{method:"POST"}).catch(()=>null)}catch{}return{summary:"agentx.json r...

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/board-dashboard-3AI2Z2SP.jsView on unpkg · L5636

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 5

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/board-dashboard-3AI2Z2SP.jsView on unpkg

1import{B as Ot,C as ro,D as oo,E as so,a as zr,b as qr,c as Fr,d as Ur,e as Ae,f as Wr,g as Gr,h as jt,j as Xr,p as Kr,q as Jr,r as Vr,s as Yr,t as Qr,x as Zr,y as eo}from"./chunk-... L2: ... L369: let filter={kind:'all',agent:null,node:null}; L370: async function api(op,node,body){const r=await fetch('/api/monitor/'+op+'?node='+encodeURIComponent(node),{method:body?'POST':'GET',headers:{'Content-Type':'application/json'},...(... L371: function message(s){$('notice').textContent=s;} ... L1144: return fetch(url, { credentials: 'same-origin', cache: 'no-store', signal: ac.signal }).then(function (r) { L1145: if (r.status === 401 || r.status === 403) { location.replace('/member'); return null; } L1146: if (!r.ok) throw new Error('HTTP ' + r.status); ... L1460: <button type="submit" id="p

dist/chunk-2PJKGZWP.jsView file

1Source sends the broad process environment to a literal external destination. L1: import{a as G,b as _e}from"./chunk-7I7IEX4S.js";import{a as N}from"./chunk-QIJLFPWE.js";import{existsSync as oe,readFileSync as de,writeFileSync as Ae,mkdirSync as we}from"fs";impo... L2: `)}var Y,He,W=N(()=>{"use strict";Y=[{name:"create_files",description:"Create one or more files as output. Use this when you need to generate code, documents, configs, or any file-... L3: `).split(` ... L19: ${l.summary}`)}if(o.name==="ask_user"&&o.input){let l=o.input;n=l.question,l.options?.length&&(n+=` L20: Options: ${l.options.join(", ")}`)}}return{content:r,files:t,followUp:n,tokensUsed:e.usage.input_tokens+e.usage.output_tokens}}}});import{execa as fe}from"execa";import{tmpdir as I... L21: Options:

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/chunk-2PJKGZWP.jsView on unpkg · L1

dist/chunk-L4ZS4HGJ.jsView file

45Trigger-reachable chain: manifest.main -> dist/index.js -> dist/chunk-L4ZS4HGJ.js L45: Citations (${S} article${S===1?"":"s"} walked): L46: ${k}${$}`}]}}case"agentx_wiki_patch":{let n=String(e.agent||"").trim(),s=String(e.title_or_path||"").trim(),i=String(e.instruction||"").trim();if(!n||!s||!i)return{content:[{type:"... L47: ${[d.stdout,d.stderr,d.message].filter(Boolean).map(p=>bt(String(p))).join(` L48: `).trim().slice(0,2e3)}`}]}}}case"agentx_wiki_interview":{let n=String(e.agent||"").trim(),s=String(e.topic||"").trim(),i=String(e.type||"").trim().toLowerCase(),o=Array.isArray(e.... ... L55: `);if(i===-1)break;let a=t.slice(0,i).match(/Content-Length:\s*(\d+)/);if(!a){t=t.slice(i+4);continue}let c=parseInt(a[1],10),l=i+4,d=l+c;if(t.length<d)break;let u=t.slice(l,d);t=t... L56: `);if(i

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/chunk-L4ZS4HGJ.jsView on unpkg · L45

dist/chunk-B2Q3PTPS.jsView file

12Trigger-reachable command-output exfiltration chain: manifest.main -> dist/index.js -> dist/chunk-B2Q3PTPS.js L12: L13: `)}import Je from"node-fetch";var Ke="https://api.context7.com/v1";async function vt(r,e){try{let t={"Content-Type":"application/json"};e&&(t.Authorization=`Bearer ${e}`);let o=awa... L14: ${a}`)}}return s.length?`# Relevant Library Documentation (via Context7) ... L19: L20: `)}`:""}var Ye={component:{type:"component",baseDir:"src/components",filePatterns:["*.tsx","*.vue","*.svelte","*.jsx","*.ts"],description:"UI component"},page:{type:"page",baseDir:... L21: `)}ke();var oe=class{hooks=new Map;register(e,t){if(!t.enabled)return;let o=this.createHandler(t),n={event:e,definition:t,handler:o},s=this.hooks.get(e)||[];s.push(n),s.sort((i,c)=... L22:

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/chunk-B2Q3PTPS.jsView on unpkg · L12

apps/mac-helper/build.shView file

•path = apps/mac-helper/build.sh kind = build_helper sizeBytes = 2875 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

apps/mac-helper/build.shView on unpkg

dist/chunk-E2VDBT3T.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = agentix-cli@0.130.0 matchedIdentity = npm:YWdlbnRpeC1jbGk:0.130.0 similarity = 0.775 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/chunk-E2VDBT3T.jsView on unpkg

Source & flagged code

19 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/program-ZPNEAACQ.jsView file

Findings

5 Critical10 High7 Medium6 Low

CriticalSame File Env Network Executiondist/program-ZPNEAACQ.js

CriticalHardcoded Runtime Data Exfiltrationdist/chunk-2PJKGZWP.js

CriticalCommand Output Exfiltrationdist/program-ZPNEAACQ.js

CriticalTrigger Reachable Dangerous Capabilitydist/chunk-L4ZS4HGJ.js

CriticalPrevious Version Dangerous Deltadist/chunk-E2VDBT3T.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/program-ZPNEAACQ.js

HighShell

HighCredential Redirect Persistencedist/program-ZPNEAACQ.js

HighCopied Package Dependency Bridgedist/board-dashboard-3AI2Z2SP.js

HighExternal Ai Agent Control Surface Mutationdist/program-ZPNEAACQ.js

Affected versions and remediation

This report applies to agentix-cli@0.131.0.

See all versions of agentix-cli for other recorded verdicts.

Review the evidence and your use of agentix-cli@0.131.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-09 07:26:55.760Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code