registry / AI-agent capability abuse / agentix-cli / 0.132.0

agentix-cli@0.132.0

AI operations layer for small and medium businesses. Routes Telegram, WhatsApp, GitLab, GitHub, crons, webhooks, and mesh tasks to AI agents. Web wizard for operators, CLI for engineers. Self-hosted.

AI Security Review

scanned 14d ago · by lpm-firewall-ai

The inspected postinstall behavior is a best-effort native database rebuild, and the provider excerpt sends credentials to Anthropic’s API. Agent configuration operations remain a concrete capability, but the available excerpts do not establish their activation or an attack, so a warning is appropriate.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

The activation path for these configuration operations was not established in the inspected excerpts.

Impact

These operations can alter agent configuration; the inspected evidence does not establish unauthorized changes or malicious effects.

Mechanism

The code references writing agent workspace files and installing a memory skill.

AI rationale

Evidence

dist/board-dashboard-44JPXA7J.jsdist/chunk-3K35L73A.jsdist/chunk-62NXS7PT.jsdist/chunk-7D3RJSN4.jsdist/chunk-AV7T3SYT.jsdist/chunk-JRVJXAVC.jsdist/chunk-MEFPXHQJ.js

Decision evidence

public snapshot

AI called this Suspicious at 72.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The postinstall hook is limited to checking and rebuilding the better-sqlite3 native binding when its ABI mismatches.
The CLI reads Claude credentials from expected local credential files; the inspected provider sends requests to Anthropic’s API.
The inspected integration code creates or updates agent workspace files and installs a memory skill, indicating agent configuration capabilities whose exact activation path was not established.

Evidence against

The inspected postinstall code does not mutate an AI-agent control surface or send data to a remote endpoint.
The inspected Anthropic provider uses the credential for requests to the intended Anthropic API endpoint.

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

Manifest

Source & flagged code

19 flagged

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/chunk-JRVJXAVC.jsView file

1import{a as Te,b as w,c as D,d as Pe,e as te,f as ne,g as M,h as ae,i as N,j as O,n as Re,o as ze,p as De,q as _e}from"./chunk-MCBTVNPX.js";import{e as Ce,i as Ee}from"./chunk-KFIJ... L2: <div class="ax-topbar__left">

High

Child Process

Package source references child process execution.

dist/chunk-JRVJXAVC.jsView on unpkg · L1

dist/chunk-62NXS7PT.jsView file

50Citations (${S} article${S===1?"":"s"} walked): L51: ${b}${I}`}]}}case"agentx_wiki_patch":{let n=String(e.agent||"").trim(),s=String(e.title_or_path||"").trim(),i=String(e.instruction||"").trim();if(!n||!s||!i)return{content:[{type:"... L52: ${[d.stdout,d.stderr,d.message].filter(Boolean).map(m=>$t(String(m))).join(` L53: `).trim().slice(0,2e3)}`}]}}}case"agentx_wiki_interview":{let n=String(e.agent||"").trim(),s=String(e.topic||"").trim(),i=String(e.type||"").trim().toLowerCase(),o=Array.isArray(e.... ... L60: `);if(i===-1)break;let a=t.slice(0,i).match(/Content-Length:\s*(\d+)/);if(!a){t=t.slice(i+4);continue}let c=parseInt(a[1],10),l=i+4,d=l+c;if(t.length<d)break;let u=t.slice(l,d);t=t... L61: `);if(i===-1)break;let o=t.slice(0,i).trim();t=t.slice(i+1),o&&Vu(o,e)}}),process.stdin.o

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

dist/chunk-62NXS7PT.jsView on unpkg · L50

50Trigger-reachable chain: manifest.main -> dist/index.js -> dist/chunk-62NXS7PT.js L50: Citations (${S} article${S===1?"":"s"} walked): L51: ${b}${I}`}]}}case"agentx_wiki_patch":{let n=String(e.agent||"").trim(),s=String(e.title_or_path||"").trim(),i=String(e.instruction||"").trim();if(!n||!s||!i)return{content:[{type:"... L52: ${[d.stdout,d.stderr,d.message].filter(Boolean).map(m=>$t(String(m))).join(` L53: `).trim().slice(0,2e3)}`}]}}}case"agentx_wiki_interview":{let n=String(e.agent||"").trim(),s=String(e.topic||"").trim(),i=String(e.type||"").trim().toLowerCase(),o=Array.isArray(e.... ... L60: `);if(i===-1)break;let a=t.slice(0,i).match(/Content-Length:\s*(\d+)/);if(!a){t=t.slice(i+4);continue}let c=parseInt(a[1],10),l=i+4,d=l+c;if(t.length<d)break;let u=t.slice(l,d);t=t... L61: `);if(i

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/chunk-62NXS7PT.js

dist/chunk-KA2UIZXG.jsView file

1import{b as F,c as S,d as $,f as x}from"./chunk-GQ76J72O.js";import{a as B,b as j,c as v}from"./chunk-ILEC3IAV.js";import{createHash as X}from"crypto";import{existsSync as z,statSy... L2: `),_(e,r)}var Q=r=>Atomics.wait(new Int32Array(new SharedArrayBuffer(4)),0,0,r),p=new Set,w=(r,t)=>{try{return Date.now()-J(r).mtimeMs>t}catch{return!1}};function U(r,t){let e=`${r... L3: //# sourceMappingURL=chunk-KA2UIZXG.js.map

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/chunk-KA2UIZXG.jsView on unpkg · L1

dist/program-SA5O6IQ3.jsView file

1import{a as rm,b as Tr,g as im}from"./chunk-RYGVTAP4.js";import{b as sm}from"./chunk-A6QJ4VFT.js";import{A as Qg,C as ba,D as Zg,F as em,a as Rg,e as Gt,f as _g,g as Dg,h as Fg,i a... L2: Computer-use helper \u2192 ${tt(i,gr)} ... L5: Starts at login \u2192 ${a.file}${c.map(d=>` L6: Removes duplicate login item \u2192 ${d.file}`).join("")}`),e.dryRun)return;try{Tt("xcrun",["--find","swiftc"],{stdio:"pipe"})}catch{throw new Error("Apple command-line tools are r... L7: Allow Microphone for the app and Accessibility / Screen Recording for the helper when macOS asks.

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

dist/program-SA5O6IQ3.jsView on unpkg · L1

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/program-SA5O6IQ3.js: import{a as rm,b as Tr,g as im}from"./chunk-RYGVTAP4.js";import{b as sm}from"./chunk-A6QJ4VFT.js";import{A as Qg,C as ba,D as Zg,F as em,a as Rg,e as Gt,f as _g,g as Dg,h as Fg,i a... The AgentX daemon and a speech transcription backend must also be available. Run agentx desktop status to inspect the login service.`)}finally{lm(g,{recursive:!0,force:!0})}});An.c... `),{path:t,changed:i,events:r,guardInstalled:!1}}function $s(e=ws()){if(!_r(e))return!1;try{return!!JSON.parse(Dr(e,"utf-8"))?.hooks?.Stop?.some?.(o=>Nr(o,Ea))}catch{return!1}}var ... `:"")+r.subarray(0,i).toString("utf8")}finally{await t.close()}aw

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/program-SA5O6IQ3.jsView on unpkg

dist/chunk-2PJKGZWP.jsView file

1Source sends the broad process environment to a literal external destination. L1: import{a as G,b as _e}from"./chunk-7I7IEX4S.js";import{a as N}from"./chunk-QIJLFPWE.js";import{existsSync as oe,readFileSync as de,writeFileSync as Ae,mkdirSync as we}from"fs";impo... L2: `)}var Y,He,W=N(()=>{"use strict";Y=[{name:"create_files",description:"Create one or more files as output. Use this when you need to generate code, documents, configs, or any file-... L3: `).split(` ... L19: ${l.summary}`)}if(o.name==="ask_user"&&o.input){let l=o.input;n=l.question,l.options?.length&&(n+=` L20: Options: ${l.options.join(", ")}`)}}return{content:r,files:t,followUp:n,tokensUsed:e.usage.input_tokens+e.usage.output_tokens}}}});import{execa as fe}from"execa";import{tmpdir as I... L21: Options:

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/chunk-2PJKGZWP.jsView on unpkg · L1

dist/board-dashboard-44JPXA7J.jsView file

5641package = agentix-cli; repositoryIdentity = agentx; dependency = cronstrue L5641: ${s||"You are "+a+"."} L5642: `)}catch{}return{summary:l}}function tp(t){let e=String(t?.id||"").trim();if(!e)throw new Error("Agent id is required.");let a=t?.patch||{},{summary:n}=C(r=>{if(!r.agents?.[e])thro... L5643: `,"utf-8");try{let s=X().dashboard.daemonUrl?.replace(/\/+$/,"")||"http://127.0.0.1:18800";fetch(`${s}/reload`,{method:"POST"}).catch(()=>null)}catch{}return{summary:"agentx.json r...

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/board-dashboard-44JPXA7J.jsView on unpkg · L5641

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 4

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/board-dashboard-44JPXA7J.jsView on unpkg

apps/mac-helper/build.shView file

•path = apps/mac-helper/build.sh kind = build_helper sizeBytes = 2875 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

apps/mac-helper/build.shView on unpkg

Source & flagged code

19 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/chunk-JRVJXAVC.jsView file

High

Child Process

Package source references child process execution.

dist/chunk-JRVJXAVC.jsView on unpkg · L1

Findings

5 Critical10 High7 Medium6 Low

CriticalSame File Env Network Executiondist/program-SA5O6IQ3.js

CriticalHardcoded Runtime Data Exfiltrationdist/chunk-2PJKGZWP.js

CriticalCommand Output Exfiltrationdist/chunk-62NXS7PT.js

CriticalTrigger Reachable Dangerous Capabilitydist/chunk-62NXS7PT.js

CriticalPrevious Version Dangerous Deltadist/chunk-62NXS7PT.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/chunk-JRVJXAVC.js

HighShell

HighCredential Redirect Persistencedist/program-SA5O6IQ3.js

HighCopied Package Dependency Bridgedist/board-dashboard-44JPXA7J.js

HighExternal Ai Agent Control Surface Mutationdist/program-SA5O6IQ3.js

Affected versions and remediation

This report applies to agentix-cli@0.132.0.

See all versions of agentix-cli for other recorded verdicts.

Review the evidence and your use of agentix-cli@0.132.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-09 08:09:17.765Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code