registry / agentix-cli / 0.138.0

agentix-cli@0.138.0

AI operations layer for small and medium businesses. Routes Telegram, WhatsApp, GitLab, GitHub, crons, webhooks, and mesh tasks to AI agents. Web wizard for operators, CLI for engineers. Self-hosted.

AI Security Review

scanned 10d ago · by lpm-firewall-ai

Inspected high-risk hints resolve to provider authentication and package-owned agent workspace features. The install hook performs a guarded native dependency repair, with no concrete attack behavior identified.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

Installation runs the postinstall hook; provider requests occur during runtime generation.

Impact

No unrelated credential disclosure or other confirmed attack effect was found.

Mechanism

The hook checks for a native ABI mismatch before rebuilding the database dependency. Provider requests use credentials with the intended Anthropic API endpoint.

AI rationale

Network endpoints1

api.anthropic.com/v1/messages

Decision evidence

public snapshot

AI called this Clean at 90.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The manifest’s postinstall runs a script that exits for other package names; the inspected work is limited to native database repair.
The inspected credential-bearing provider requests send API-key-authenticated messages to Anthropic’s API, matching the provider’s intended service.
The indicated agent configuration code reads workspace instructions and creates or updates AgentX-managed memory and skill files.
The reviewed entrypoint, declarations, CLI, and UI bundles are application modules; the inspected monitor request sends data to a configured daemon.

Evidence against

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 226 file(s), 5.14 MB of source, external domains: 100.64.0.11, 100.x.x.x, 127.0.0.1, 192.168.1.50, api.anthropic.com, api.context7.com, api.deepseek.com, api.elevenlabs.io, api.example.com, api.github.com, api.openai.com, api.telegram.org, api.typesafe.ai, claude.ai, console.anthropic.com, docs.anthropic.com, docs.claude.com, example.com, example.org, fonts.googleapis.com, fonts.gstatic.com, github.com, gitlab.com, gitlab.example.com, host.example.ts.net, my-mac.tailnet-name.ts.net, ntfy.sh, opencode.ai, openrouter.ai, peer.example.com, pro.reactflow.dev, raw.githubusercontent.com, reactflow.dev, reactjs.org, status.anthropic.com, t.me, unpkg.com, wacli.sh, www.apple.com, www.w3.org, x.com, x.tld

Source & flagged code

19 flagged

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/chunk-TVW5ZKJY.jsView file

1import{a as Re,b as w,c as z,d as Pe,e as ie,f as se,g as M,h as le,i as N,j as O,n as De,o as ze,p as _e,q as We}from"./chunk-H4NSB54D.js";import{b as oe}from"./chunk-MTX4UPNB.js"... L2: <div class="ax-topbar__left">

High

Child Process

Package source references child process execution.

dist/chunk-TVW5ZKJY.jsView on unpkg · L1

dist/chunk-UPNKRCFX.jsView file

50L51: ${E}${j}`}]}}case"agentx_wiki_patch":{let n=String(e.agent||"").trim(),s=String(e.title_or_path||"").trim(),i=String(e.instruction||"").trim();if(!n||!s||!i)return{content:[{type:"... L52: ${[d.stdout,d.stderr,d.message].filter(Boolean).map(g=>St(String(g))).join(` L53: `).trim().slice(0,2e3)}`}]}}}case"agentx_wiki_interview":{let n=String(e.agent||"").trim(),s=String(e.topic||"").trim(),i=String(e.type||"").trim().toLowerCase(),o=Array.isArray(e.... ... L60: `);if(i===-1)break;let a=t.slice(0,i).match(/Content-Length:\s*(\d+)/);if(!a){t=t.slice(i+4);continue}let c=parseInt(a[1],10),l=i+4,d=l+c;if(t.length<d)break;let u=t.slice(l,d);t=t... L61: `);if(i===-1)break;let o=t.slice(0,i).trim();t=t.slice(i+1),o&&lh(o,e)}}),process.stdin.on("end",()=>{e("stdin closed, shutting down."),

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

dist/chunk-UPNKRCFX.jsView on unpkg · L50

50Trigger-reachable chain: manifest.main -> dist/index.js -> dist/chunk-UPNKRCFX.js L50: L51: ${E}${j}`}]}}case"agentx_wiki_patch":{let n=String(e.agent||"").trim(),s=String(e.title_or_path||"").trim(),i=String(e.instruction||"").trim();if(!n||!s||!i)return{content:[{type:"... L52: ${[d.stdout,d.stderr,d.message].filter(Boolean).map(g=>St(String(g))).join(` L53: `).trim().slice(0,2e3)}`}]}}}case"agentx_wiki_interview":{let n=String(e.agent||"").trim(),s=String(e.topic||"").trim(),i=String(e.type||"").trim().toLowerCase(),o=Array.isArray(e.... ... L60: `);if(i===-1)break;let a=t.slice(0,i).match(/Content-Length:\s*(\d+)/);if(!a){t=t.slice(i+4);continue}let c=parseInt(a[1],10),l=i+4,d=l+c;if(t.length<d)break;let u=t.slice(l,d);t=t... L61: `);if(i===-1)break;let o=t.slice(0,i).trim();t=t.slice

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/chunk-UPNKRCFX.jsView on unpkg · L50

dist/chunk-4ZWZ42YE.jsView file

1import{b as F}from"./chunk-PE5V2LI7.js";import{c as u,j as g,k as f}from"./chunk-GQ76J72O.js";import{a as l}from"./chunk-ILEC3IAV.js";import{d}from"./chunk-OWNQ2FD4.js";import{crea... L2: `),pinned:r,proposals:[]};let o=[],i;try{o=I(new F(t),e.map(n=>({claim:n,...s})))}catch(n){i=String(n?.message??n)}let c=e.map((n,p)=>`- UNVERIFIED claim (${o[p]?`wiki proposal ${o...

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/chunk-4ZWZ42YE.jsView on unpkg · L1

dist/program-KMUCHLDU.jsView file

1import{a as xm,b as Mr,g as Sm}from"./chunk-UPQTTOVQ.js";import{b as bm}from"./chunk-Y7IHOQC7.js";import{A as gm,B as mm,D as Oa,E as um,G as pm,H as fm,I as hm,a as Jg,e as Ht,f a... L2: Computer-use helper \u2192 ${ot(i,br)} ... L5: Starts at login \u2192 ${a.file}${c.map(d=>` L6: Removes duplicate login item \u2192 ${d.file}`).join("")}`),e.dryRun)return;try{Tt("xcrun",["--find","swiftc"],{stdio:"pipe"})}catch{throw new Error("Apple command-line tools are r... L7: Allow Microphone for the app and Accessibility / Screen Recording for the helper when macOS asks.

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

dist/program-KMUCHLDU.jsView on unpkg · L1

•matchType = previous_version_dangerous_delta matchedPackage = agentix-cli@0.137.3 matchedIdentity = npm:YWdlbnRpeC1jbGk:0.137.3 similarity = 0.975 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/program-KMUCHLDU.jsView on unpkg

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/program-KMUCHLDU.js: import{a as xm,b as Mr,g as Sm}from"./chunk-UPQTTOVQ.js";import{b as bm}from"./chunk-Y7IHOQC7.js";import{A as gm,B as mm,D as Oa,E as um,G as pm,H as fm,I as hm,a as Jg,e as Ht,f a... The AgentX daemon and a speech transcription backend must also be available. Run agentx desktop status to inspect the login service.`)}finally{Cm(g,{recursive:!0,force:!0})}});jn.c... `),{path:t,changed:i,events:r,guardInstalled:!1}}function Es(e=As()){if(!Br(e))return!1;try{return!!JSON.parse(Jr(e,"utf-8"))?.hooks?.Stop?.some?.(o=>Wr(o,_a))}catch{return!1}}var ... `:"")+r.subarray(0,i).toString("utf8")}finally{await t.close()}aw

dist/chunk-2PJKGZWP.jsView file

1Source sends the broad process environment to a literal external destination. L1: import{a as G,b as _e}from"./chunk-7I7IEX4S.js";import{a as N}from"./chunk-QIJLFPWE.js";import{existsSync as oe,readFileSync as de,writeFileSync as Ae,mkdirSync as we}from"fs";impo... L2: `)}var Y,He,W=N(()=>{"use strict";Y=[{name:"create_files",description:"Create one or more files as output. Use this when you need to generate code, documents, configs, or any file-... L3: `).split(` ... L19: ${l.summary}`)}if(o.name==="ask_user"&&o.input){let l=o.input;n=l.question,l.options?.length&&(n+=` L20: Options: ${l.options.join(", ")}`)}}return{content:r,files:t,followUp:n,tokensUsed:e.usage.input_tokens+e.usage.output_tokens}}}});import{execa as fe}from"execa";import{tmpdir as I... L21: Options:

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/chunk-2PJKGZWP.jsView on unpkg · L1

dist/board-dashboard-33NGOGWC.jsView file

5641package = agentix-cli; repositoryIdentity = agentx; dependency = cronstrue L5641: ${s||"You are "+a+"."} L5642: `)}catch{}return{summary:l}}function wp(t){let e=String(t?.id||"").trim();if(!e)throw new Error("Agent id is required.");let a=t?.patch||{},{summary:n}=C(r=>{if(!r.agents?.[e])thro... L5643: `,"utf-8");try{let s=X().dashboard.daemonUrl?.replace(/\/+$/,"")||"http://127.0.0.1:18800";fetch(`${s}/reload`,{method:"POST"}).catch(()=>null)}catch{}return{summary:"agentx.json r...

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/board-dashboard-33NGOGWC.jsView on unpkg · L5641

dist/chunk-GAIXI26T.jsView file

12Trigger-reachable command-output exfiltration chain: manifest.main -> dist/index.js -> dist/chunk-GAIXI26T.js L12: L13: `)}import Je from"node-fetch";var Ke="https://api.context7.com/v1";async function vt(r,e){try{let t={"Content-Type":"application/json"};e&&(t.Authorization=`Bearer ${e}`);let o=awa... L14: ${a}`)}}return s.length?`# Relevant Library Documentation (via Context7) ... L19: L20: `)}`:""}var Ye={component:{type:"component",baseDir:"src/components",filePatterns:["*.tsx","*.vue","*.svelte","*.jsx","*.ts"],description:"UI component"},page:{type:"page",baseDir:... L21: `)}ke();var oe=class{hooks=new Map;register(e,t){if(!t.enabled)return;let o=this.createHandler(t),n={event:e,definition:t,handler:o},s=this.hooks.get(e)||[];s.push(n),s.sort((i,c)=... L22:

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/chunk-GAIXI26T.jsView on unpkg · L12

apps/mac-helper/build.shView file

•path = apps/mac-helper/build.sh kind = build_helper sizeBytes = 2875 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

apps/mac-helper/build.shView on unpkg

dist/chunk-AV7T3SYT.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 6

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/chunk-AV7T3SYT.js#virtual:normalized:round1View on unpkg

Source & flagged code

19 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/chunk-TVW5ZKJY.jsView file

High

Child Process

Package source references child process execution.

dist/chunk-TVW5ZKJY.jsView on unpkg · L1

Findings

5 Critical10 High7 Medium6 Low

CriticalSame File Env Network Executiondist/program-KMUCHLDU.js

CriticalHardcoded Runtime Data Exfiltrationdist/chunk-2PJKGZWP.js

CriticalCommand Output Exfiltrationdist/chunk-UPNKRCFX.js

CriticalTrigger Reachable Dangerous Capabilitydist/chunk-UPNKRCFX.js

CriticalPrevious Version Dangerous Deltadist/program-KMUCHLDU.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/chunk-TVW5ZKJY.js

HighShell

HighCredential Redirect Persistencedist/program-KMUCHLDU.js

HighCopied Package Dependency Bridgedist/board-dashboard-33NGOGWC.js

HighExternal Ai Agent Control Surface Mutationdist/program-KMUCHLDU.js

Affected versions and remediation

This report applies to agentix-cli@0.138.0.

See all versions of agentix-cli for other recorded verdicts.

Review the evidence and your use of agentix-cli@0.138.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-13 11:28:32.401Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.