registry / AI-agent capability abuse / agentix-cli / 0.25.0

agentix-cli@0.25.0

AI operations layer for small & medium businesses. Routes Telegram, WhatsApp, Slack, Discord, GitLab, crons, webhooks, and mesh tasks to AI agents on Claude, OpenAI, or any LLM. Web wizard for non-technical operators, CLI for engineers. Self-hosted.

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

This is not concrete malicious behavior or an unconsented lifecycle attack, but the explicit global agent configuration mutation and credential harvesting capability warrant a warning.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

User runs `agentx attach install` or configures/runs an Anthropic-backed AgentX command.

Impact

Changes user-scope AI-agent hook configuration and can use discovered local credentials for model requests.

Mechanism

Explicit global Claude hook setup and local credential reuse.

AI rationale

This is not concrete malicious behavior or an unconsented lifecycle attack, but the explicit global agent configuration mutation and credential harvesting capability warrant a warning.

Evidence

package.jsondist/cli.jsdist/chunk-KUCCW2VG.jsdist/chunk-FDWOECJY.js~/.claude/settings.json~/.agentx/auth.json~/.openclaw/agents/main/agent/auth-profiles.json~/.openclaw/auth-profiles.json~/.openclaw/credentials/oauth.json~/.claude/oauth.json~/.config/claude/oauth.json~/.config/anthropic/oauth.json

Network endpoints1

api.anthropic.com/v1/messages

Decision evidence

public snapshot

AI called this Suspicious at 87.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

Explicit `agentx attach install` patches `~/.claude/settings.json` with hooks.
Credential resolver reads OpenClaw/Claude OAuth files and saves selected credentials under `~/.agentx/auth.json`.
Configured Anthropic requests send credentials only to Anthropic's official API endpoint.

Evidence against

The declared postinstall target `scripts/postinstall.mjs` is absent from the package, so no install-time mutation can run.
CLI entrypoint only parses user-supplied commands; no-argument execution shows help.
Global Claude hook mutation is behind the explicit `agentx attach install` command.
No fixed unofficial credential receiver or remote payload download was confirmed.

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedUrlStrings

Manifest

Source & flagged code

15 flagged

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/chunk-LNXCJWOU.jsView file

1import{a as K,b as X,c as D,d as I,e as M,f as W}from"./chunk-P4VWIVKN.js";import{f as B}from"./chunk-JXWAGMI2.js";import{f as J}from"./chunk-BFXONUUN.js";import{existsSync as _,re... L2: `,p=n+".tmp";j(p,o,"utf-8");try{JSON.parse(Y(p,"utf-8"))}catch(d){throw new Error(`config did not round-trip cleanly: ${d.message}`)}let i;return t.skipBackup||(i=`${n}.bak.${Date....

High

Child Process

Package source references child process execution.

dist/chunk-LNXCJWOU.jsView on unpkg · L1

dist/chunk-NGSIRE4X.jsView file

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. dist/chunk-NGSIRE4X.js: import{a as He,b as De,c as ve}from"./chunk-SFQUP3BP.js";import{a as X,c as Ue,e as ye,f as we,h as ke,m as be}from"./chunk-FDWOECJY.js";import{a as R}from"./chunk-VJUTQAPJ.js";imp... `)}import We from"node-fetch";var ze="https://api.context7.com/v1";async function wt(r,e){try{let t={"Content-Type":"application/json"};e&&(t.Authorization=`Bearer ${e}`);let o=awa... `)}`:""}var Ke={component:{type:"component",baseDir:"src/components",filePatterns:["*.tsx","*.vue","*.svelte","*.jsx","*.ts"],description:"UI component"},page:{type:"page",baseDir:... `)}var oe=class{hooks=new Map;register(e,t){if(!t.enabled)return;let o=this.createHandle

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

dist/chunk-NGSIRE4X.jsView on unpkg

12Trigger-reachable command-output exfiltration chain: manifest.main -> dist/index.js -> dist/chunk-NGSIRE4X.js L12: L13: `)}import We from"node-fetch";var ze="https://api.context7.com/v1";async function wt(r,e){try{let t={"Content-Type":"application/json"};e&&(t.Authorization=`Bearer ${e}`);let o=awa... L14: ${a}`)}}return s.length?`# Relevant Library Documentation (via Context7) ... L19: L20: `)}`:""}var Ke={component:{type:"component",baseDir:"src/components",filePatterns:["*.tsx","*.vue","*.svelte","*.jsx","*.ts"],description:"UI component"},page:{type:"page",baseDir:... L21: `)}var oe=class{hooks=new Map;register(e,t){if(!t.enabled)return;let o=this.createHandler(t),n={event:e,definition:t,handler:o},s=this.hooks.get(e)||[];s.push(n),s.sort((i,c)=>i.de... L22:

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/chunk-NGSIRE4X.js

dist/ingest-whatsapp-LZE62INA.jsView file

1import"./chunk-4YCH6IZV.js";import{createHash as C}from"crypto";function $(e,n){if(!e.enabled)return[];let t=n.listContacts(),d=n.listChats(),i=[],a=r=>r.replace(/^\+/,"").toLowerC... L2: `),meta:{jid:e.jid,phone:e.phone,kind:"contact",profileHash:x(e)}}}function k(e,n,t=new Date){let d=h(t),i=`wa-group-meta-${w(e.jid)}-${l(t)}`,a=[`# Group: ${e.subject||"(unnamed)"...

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/ingest-whatsapp-LZE62INA.jsView on unpkg · L1

dist/chunk-KUCCW2VG.jsView file

1import{a as Ks,b as kt,g as Vs}from"./chunk-G57RZCXM.js";import{b as qs}from"./chunk-TRJTTBE2.js";import{a as Ao,b as Fs,f as bt,j as Ys}from"./chunk-LNXCJWOU.js";import{a as zs,c ... L2: `)){let n=t.trim();if(!n||n.startsWith("#"))continue;let s=n.indexOf("=");if(s<0)continue;let i=n.slice(0,s).trim();if(!i||process.env[i]!==void 0)continue;let r=n.slice(s+1).trim(... L3: `));try{let s=await fetch(n);if(!s.ok||!s.body){console.log(j.red(` Failed: ${s.status}`));return}let i=s.body.getReader(),r=new TextDecoder,a="";for(;;){let{done:c,value:d}=await...

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

dist/chunk-KUCCW2VG.jsView on unpkg · L1

204message: "coder-agent is not permitted to run commands against production." L205: `,ci=[{relPath:"policy.yaml",content:ma},{relPath:"environments/production.yaml",content:pa},{relPath:"agents/coder-agent.yaml",content:ua}];var Ze=new fa().name("guard").descripti... L206: `)),{path:t,changed:d,events:a,guardInstalled:c}}function fi(e={}){let o=e.path??et();if(!At(o))return{path:o,changed:!1,events:[],guardInstalled:!1};let t;try{t=JSON.parse(Ot(o,"u... L207: `),{path:o,changed:r,events:i,guardInstalled:!1}}function Ct(e=et()){if(!At(e))return!1;try{return!!JSON.parse(Ot(e,"utf-8"))?.hooks?.Stop?.some?.(t=>It(t,wn))}catch{return!1}}var ... L208: ${i} registered session(s) with no binding.`)),console.log()}catch(t){console.error(C.red(`Could not read attach state: ${xn(t)}`)),process.ex

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

dist/chunk-KUCCW2VG.jsView on unpkg · L204

dist/chunk-FDWOECJY.jsView file

1Source sends the broad process environment to a literal external destination. L1: import{a as N}from"./chunk-VJUTQAPJ.js";import{existsSync as te,readFileSync as ie,writeFileSync as ue,mkdirSync as de}from"fs";import S from"path";import ae from"os";import J from... L2: `)}var je=B.map(a=>a.name);var H="claude-sonnet-4-20250514",Y=8192,we=4*1024;function W(a){return!a||a.length<we?a:[{type:"text",text:a,cache_control:{type:"ephemeral"}}]}var L=cla... L3: `).split(` ... L19: ${l.summary}`)}if(o.name==="ask_user"&&o.input){let l=o.input;n=l.question,l.options?.length&&(n+=` L20: Options: ${l.options.join(", ")}`)}}return{content:r,files:t,followUp:n,tokensUsed:e.usage.input_tokens+e.usage.output_tokens}}};import{execa as ce}from"execa";var q="claude-sonnet... L21: Options: ... L25: L26: `),y

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/chunk-FDWOECJY.jsView on unpkg · L1

dist/index.jsView file

1package = agentix-cli; repositoryIdentity = agentx; dependency = fast-glob L1: import{a as U}from"./chunk-JP5IEXR7.js";import{a as xt,b as re,c as ae,d as Ct,e as Pt,f as bt,u as $t,v as Tt,w as Rt}from"./chunk-TMKLHTCG.js";import"./chunk-3WQFCIB6.js";import{... L2: `)}

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/index.jsView on unpkg · L1

dist/chunk-TMKLHTCG.jsView file

1Cross-file remote execution chain: dist/chunk-TMKLHTCG.js spawns dist/chunk-LDHPMJ7M.js; helper contains network access plus dynamic code execution. L1: import{f as Ds,g as Os}from"./chunk-3WQFCIB6.js";import{C as Cs,a as Ct,b as Bn,c as Jn,j as Ne,k as Y,m as Xn,n as K,o as vs,p as $s,q as Ss,r as Is,s as xs,t as Ts,v as As}from".... L2: Created ${o.files.written.length} file(s): ... L18: L19: `)}`}]}:{content:[{type:"text",text:"No matching skills found. Install skills with: agentx skill install <owner/repo>"}]}}case"agentx_detect_output_type":{let n=e.task;return{conte... L20: `)}]}}case"agentx_send_contact":{let n=e.contactName,s=e.text,r=e.channel,o=e.confirmed===!0,a=e.agentId;if(!n||!s)return{content:[{type:"text",text:"Error: contactName and text ar... ... L28: Citations (${m} art

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/chunk-TMKLHTCG.jsView on unpkg · L1

Source & flagged code

15 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/chunk-LNXCJWOU.jsView file

High

Child Process

Package source references child process execution.

Findings

4 Critical8 High5 Medium6 Low

CriticalSame File Env Network Executiondist/chunk-KUCCW2VG.js

CriticalHardcoded Runtime Data Exfiltrationdist/chunk-FDWOECJY.js

CriticalCommand Output Exfiltrationdist/chunk-KUCCW2VG.js

CriticalTrigger Reachable Dangerous Capabilitydist/chunk-KUCCW2VG.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/chunk-LNXCJWOU.js

HighCredential Redirect Persistencedist/chunk-KUCCW2VG.js

HighEntrypoint Foreign Package Code Overwritedist/chunk-NGSIRE4X.js

HighCopied Package Dependency Bridgedist/index.js

HighExternal Ai Agent Control Surface Mutationdist/chunk-KUCCW2VG.js

High

Affected versions and remediation

This report applies to agentix-cli@0.25.0.

See all versions of agentix-cli for other recorded verdicts.

Review the evidence and your use of agentix-cli@0.25.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-08-25 14:47:04.114Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code