registry / agentix-cli / 0.28.0

agentix-cli@0.28.0

AI operations layer for small and medium businesses. Routes Telegram, WhatsApp, GitLab, GitHub, crons, webhooks, and mesh tasks to AI agents. Web wizard for operators, CLI for engineers. Self-hosted.

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

The only lifecycle script rebuilds the declared better-sqlite3 native binding and exits successfully on every other path. Cron shells, Anthropic API calls, local config writes, and plugin loading are operator-invoked features of this self-hosted agent CLI.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

npm runs scripts/postinstall.mjs after install; shell and network behavior starts only when an operator runs the CLI or daemon.

Impact

Install does not steal credentials, fetch a remote payload, or rewrite foreign AI-agent control files.

Mechanism

The hook exits unless the installed package name is agentix-cli and better-sqlite3 throws an ABI mismatch, then it runs the package manager rebuild for that module.

AI rationale

Decision evidence

public snapshot

AI called this Clean at 84.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

postinstall only rebuilds better-sqlite3 on a native ABI mismatch and otherwise exits 0
Cron jobs run an operator-configured command via /bin/sh only after the daemon scheduler starts
Model requests send the configured Anthropic credential to api.anthropic.com
Plugins must export a default AgentXPlugin manifest and setup pair before the daemon uses them
Guardrails load from .agentx/guardrails and default to warn mode
Setup and the board UI write local agentx.json and talk to the local daemon

Evidence against

No preinstall hook, self-dependency, obfuscated payload, or install-time write to foreign agent config files
Shell execution and local OAuth file reads are tied to operator CLI, cron, and provider setup rather than install

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinified

Source & flagged code

20 flagged

package.jsonView file

Lines 54-94json

54 "scripts": {

55 "build": "tsup && tsup --config tsup.web.config.ts",

56 "build:web": "tsup --config tsup.web.config.ts",

57 "dev": "tsup --watch",

58 "typecheck": "tsc --noEmit",

59 "test": "vitest run",

60 "clean": "rimraf dist",

61 "format:write": "prettier --write \"src/**/*.{ts,tsx,mdx}\" --cache",

62 "format:check": "prettier --check \"src/**/*.{ts,tsx,mdx}\" --cache",

63 "eval": "vitest run test/eval/",

64 "eval:track": "TRACK_SCORES=1 vitest run test/eval/real-data-eval.test.ts",

65 "usage:track": "tsx src/scripts/track-usage.ts",

66 "docs:dev": "vitepress dev docs",

67 "docs:build": "vitepress build docs",

68 "docs:check": "node docs/.scripts/check-sidebar.mjs && vitepress build docs",

69 "docs:demo": "node dist/cli.js demo --no-open --keep",

70 "docs:seed": "node docs/.scripts/seed-demo.mjs",

71 "docs:shots": "node docs/.scripts/capture.mjs",

72 "docs:preview": "vitepress preview docs",

73 "prepublishOnly": "npm run build",

74 "postinstall": "node scripts/postinstall.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L74

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L74

75 },

76 "dependencies": {

77 "@roamhq/wrtc": "^0.10.0",

78 "@types/better-sqlite3": "^7.6.13",

79 "@types/js-yaml": "^4.0.9",

80 "@whiskeysockets/baileys": "7.0.0-rc.9",

81 "@xyflow/react": "^12.10.2",

82 "better-sqlite3": "^12.9.0",

83 "chalk": "5.2.0",

84 "cli-highlight": "^2.1.11",

85 "commander": "^10.0.0",

86 "cosmiconfig": "^8.1.3",

87 "cronstrue": "^3.14.0",

88 "execa": "^7.0.0",

89 "fast-glob": "^3.3.2",

90 "fs-extra": "^11.2.0",

91 "ink": "^5.0.1",

92 "js-yaml": "^4.1.1",

93 "marked": "^15.0.12",

94 "marked-terminal": "^7.3.0",

dist/chunk-ZMYGXHPT.jsView file

Lines 1-21javascript

1import{a as L,b as S}from"./chunk-SCTIUFL4.js";import{a as T,b as M}from"./chunk-ZTEU5JVQ.js";import{a as C,b as q}from"./chunk-L2WSPY6S.js";import{e

dist/chunk-MHIMGM4G.jsView file

Lines 1-40javascript

1import{a as Ge,b as Fe,c as Se}from"./chunk-SFQUP3BP.js";import{b as Te,c as Ce}from"./chunk-QOYAX2FT.js";import{a as Q,c as Ne,e as we,f as

dist/ingest-whatsapp-NS4OWDOU.jsView file

Lines 1-6javascript

1import"./chunk-FIOB3MEX.js";import{createHash as C}from"crypto";function $(e,n){if(!e.enabled)return[];let t=n.listContacts

dist/chunk-VIH7ARPF.jsView file

Lines 1-31javascript

1import{a as mr,b as on,g as pr}from"./chunk-5IA2CYHN.js";import{a as Yo,b as rr,f as en,j as gr}from"./chunk-3LYM22IV.js";import{a as cr,c as

dist/chunk-LCIREYTD.jsView file

Lines 1-21javascript

1import{a as G,b as _e}from"./chunk-L2WSPY6S.js";import{b as N}from"./chunk-FIOB3MEX.js";import{existsSync as oe,readFileSync as de,writeFileSync as ke,mkdirSync as Ae}from"fs"

dist/chunk-E3UJHQGN.jsView file

18L19: `)}`}]}:{content:[{type:"text",text:"No matching skills found. Install skills with: agentx skill install <owner/repo>"}]}}case"agentx_detect_output_type":{let n=e.task;return{conte... L20: `)}]}}case"agentx_send_contact":{let n=e.contactName,s=e.text,r=e.channel,o=e.confirmed===!0,a=e.agentId;if(!n||!s)return{content:[{type:"text",text:"Error: contactName and text ar... ... L28: Citations (${m} article${m===1?"":"s"} walked): L29: ${w}`}]}}case"agentx_wiki_patch":{let n=String(e.agent||"").trim(),s=String(e.title_or_path||"").trim(),r=String(e.instruction||"").trim();if(!n||!s||!r)return{content:[{type:"text... L30: ${[l.stdout,l.stderr,l.message].filter(Boolean).map(g=>fe(String(g))).join(` L31: `).trim().slice(0,2e3)}`}]}}}case"agentx_wiki_interview":{let n=String(e.agent||"")

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

dist/chunk-E3UJHQGN.jsView on unpkg · L18

18Trigger-reachable chain: manifest.main -> dist/index.js -> dist/chunk-E3UJHQGN.js L18: L19: `)}`}]}:{content:[{type:"text",text:"No matching skills found. Install skills with: agentx skill install <owner/repo>"}]}}case"agentx_detect_output_type":{let n=e.task;return{conte... L20: `)}]}}case"agentx_send_contact":{let n=e.contactName,s=e.text,r=e.channel,o=e.confirmed===!0,a=e.agentId;if(!n||!s)return{content:[{type:"text",text:"Error: contactName and text ar... ... L28: Citations (${m} article${m===1?"":"s"} walked): L29: ${w}`}]}}case"agentx_wiki_patch":{let n=String(e.agent||"").trim(),s=String(e.title_or_path||"").trim(),r=String(e.instruction||"").trim();if(!n||!s||!r)return{content:[{type:"text... L30: ${[l.stdout,l.stderr,l.message].filter(Boolean).map(g=>fe(String(g))).join(` L31: `

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/chunk-E3UJHQGN.jsView on unpkg · L18

dist/board-dashboard-QR7CVTKA.jsView file

4591package = agentix-cli; repositoryIdentity = agentx; dependency = cronstrue L4591: ${s||"You are "+a+"."} L4592: `)}catch{}return{summary:i}}function Bn(t){let e=String(t?.id||"").trim();if(!e)throw new Error("Agent id is required.");let a=t?.patch||{},{summary:n}=T(r=>{if(!r.agents?.[e])thro... L4593: `,"utf-8");try{let s=G().dashboard.daemonUrl?.replace(/\/+$/,"")||"http://127.0.0.1:18800";fetch(`${s}/reload`,{method:"POST"}).catch(()=>null)}catch{}return{summary:"agentx.json r...

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/board-dashboard-QR7CVTKA.jsView on unpkg · L4591

apps/mac-helper/build.shView file

•path = apps/mac-helper/build.sh kind = build_helper sizeBytes = 1452 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

apps/mac-helper/build.shView on unpkg

dist/chunk-3LYM22IV.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/chunk-3LYM22IV.js#virtual:normalized:round1View on unpkg

scripts/postinstall.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = agentix-cli@0.27.0 matchedIdentity = npm:YWdlbnRpeC1jbGk:0.27.0 similarity = 0.912 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

scripts/postinstall.mjsView on unpkg

Source & flagged code

20 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/chunk-ZMYGXHPT.jsView file

1import{a as L,b as S}from"./chunk-SCTIUFL4.js";import{a as T,b as M}from"./chunk-ZTEU5JVQ.js";import{a as C,b as q}from"./chunk-L2WSPY6S.js";import{e as x}from"./chunk-FIOB3MEX.js"... L2: VALUES (?, ?, ?, ?, ?, ?, ?, ?)`).run(n.id,n.ts,n.source,n.sourceEventId,n.project,n.subject,n.intent,n.rawJson),n}findEventBySourceId(e,n){let t=this.db.prepare(`SELECT id, ts, so...

High

Child Process

Package source references child process execution.

Findings

5 Critical11 High7 Medium6 Low

CriticalSame File Env Network Executiondist/chunk-VIH7ARPF.js

CriticalHardcoded Runtime Data Exfiltrationdist/chunk-LCIREYTD.js

CriticalCommand Output Exfiltrationdist/chunk-E3UJHQGN.js

CriticalTrigger Reachable Dangerous Capabilitydist/chunk-E3UJHQGN.js

CriticalPrevious Version Dangerous Deltascripts/postinstall.mjs

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/chunk-ZMYGXHPT.js

HighShell

HighCredential Redirect Persistencedist/chunk-VIH7ARPF.js

HighSandbox Evasion Gated Capabilitydist/chunk-VIH7ARPF.js

HighCopied Package Dependency Bridgedist/board-dashboard-QR7CVTKA.js

Affected versions and remediation

This report applies to agentix-cli@0.28.0.

See all versions of agentix-cli for other recorded verdicts.

Review the evidence and your use of agentix-cli@0.28.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-22 16:49:54.958Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.