agentix-cli@0.26.0
AI operations layer for small & medium businesses. Routes Telegram, WhatsApp, Slack, Discord, GitLab, crons, webhooks, and mesh tasks to AI agents on Claude, OpenAI, or any LLM. Web wizard for non-technical operators, CLI for engineers. Self-hosted.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is a real agent-control and credential-handling capability, but the global configuration mutation is explicitly user-invoked and the advertised lifecycle script is not packaged. The inspected network call is provider-aligned rather than a confirmed exfiltration channel.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
The user runs agentx attach install.
Impact
Future Claude Code tool events can be routed to the local AgentX daemon.
Mechanism
Writes Claude Code hook configuration that calls a local AgentX daemon.
AI rationale
This is a real agent-control and credential-handling capability, but the global configuration mutation is explicitly user-invoked and the advertised lifecycle script is not packaged. The inspected network call is provider-aligned rather than a confirmed exfiltration channel.
Evidence
package.jsondist/chunk-UHE5FCPB.jsdist/chunk-FDWOECJY.js~/.claude/settings.json~/.openclaw/agents/main/agent/auth-profiles.json~/.openclaw/auth-profiles.json~/.openclaw/credentials/oauth.json~/.claude/oauth.json~/.config/claude/oauth.json~/.config/anthropic/oauth.json
Network endpoints1
api.anthropic.com/v1/messages
Decision evidence
public snapshotAI called this Suspicious at 86.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The manifest declares an automatic postinstall command whose target is not included in this package snapshot.
- An explicit CLI command can install hooks into the user's global Claude Code settings.
- The hook installer defaults to the home-directory Claude settings file and writes modified hook configuration.
- The provider code reads local AI authentication profiles and sends model requests to Anthropic.
Evidence against
- The postinstall target is absent, so the declared lifecycle command cannot perform the claimed setup from this package.
- The global Claude settings change requires the user to run the named attach-install command.
- The observed external request is to Anthropic's API and matches the package's configured LLM-provider function.
- No confirmed secret exfiltration endpoint, remote payload fetch, or automatic agent-control mutation was found.
Behavioral surface
ChildProcessDynamicRequireEnvironmentVarsFilesystemNetwork
Source & flagged code
15 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/postinstall.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.mjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/chunk-UHE5FCPB.jsView file
1import{a as Ks,b as kt,g as Vs}from"./chunk-O6YPEOQF.js";import{b as qs}from"./chunk-BVGJSPW4.js";import{a as Ao,b as Fs,f as bt,j as Ys}from"./chunk-V3U4OF7L.js";import{a as zs,c ...
L2: `)){let n=t.trim();if(!n||n.startsWith("#"))continue;let s=n.indexOf("=");if(s<0)continue;let i=n.slice(0,s).trim();if(!i||process.env[i]!==void 0)continue;let r=n.slice(s+1).trim(...
L3: `));try{let s=await fetch(n);if(!s.ok||!s.body){console.log(j.red(` Failed: ${s.status}`));return}let i=s.body.getReader(),r=new TextDecoder,a="";for(;;){let{done:c,value:d}=await...
Findings
5 Critical8 High5 Medium5 Low
CriticalSame File Env Network Executiondist/chunk-UHE5FCPB.js
CriticalHardcoded Runtime Data Exfiltrationdist/chunk-FDWOECJY.js
CriticalCommand Output Exfiltrationdist/chunk-UHE5FCPB.js
CriticalTrigger Reachable Dangerous Capabilitydist/chunk-UHE5FCPB.js
CriticalPrevious Version Dangerous Deltadist/chunk-E5CXCI33.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/chunk-UHE5FCPB.js
HighCredential Redirect Persistencedist/chunk-UHE5FCPB.js
HighCopied Package Dependency Bridgedist/chunk-METYYZKQ.js
HighExternal Ai Agent Control Surface Mutationdist/chunk-UHE5FCPB.js
High
Affected versions and remediation
This report applies to agentix-cli@0.26.0.
See all versions of agentix-cli for other recorded verdicts.
- Review the evidence and your use of agentix-cli@0.26.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.