agentix-cli@0.56.0
AI operations layer for small and medium businesses. Routes Telegram, WhatsApp, GitLab, GitHub, crons, webhooks, and mesh tasks to AI agents. Web wizard for operators, CLI for engineers. Self-hosted.
AI Security Review
scanned 25d ago · by lpm-firewall-aiThis is a guarded, explicit-user-command agent configuration mutation rather than an unconsented install-time compromise. It warrants a warning for its broad Claude session capability, not a publication block.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
The user runs the attach install CLI command.
Impact
Claude session events and tool inputs can be forwarded to a local service chosen by the package configuration; no confirmed external exfiltration was found.
Mechanism
The command patches the Claude settings file with command hooks that post input to the local AgentX daemon.
AI rationale
This is a guarded, explicit-user-command agent configuration mutation rather than an unconsented install-time compromise. It warrants a warning for its broad Claude session capability, not a publication block.
Evidence
dist/chunk-IL2XLW4H.js.claude/settings.json
Network endpoints1
127.0.0.1
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The package has a postinstall hook, but it exits unless a SQLite native-binding ABI mismatch requires rebuilding that dependency.
- An explicit attach install command targets the user-level Claude settings file for all sessions.
- That command adds hook definitions and writes the modified settings file.
- The installed hooks send hook input only to a loopback AgentX daemon.
Evidence against
- No automatic lifecycle code was found that installs the Claude hooks.
- No non-local endpoint was found in the hook command path.
Behavioral surface
ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
19 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/postinstall.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.mjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/facts-4YPSHIXJ.jsView file
1import"./chunk-QIJLFPWE.js";import{existsSync as E,readFileSync as T}from"fs";import{resolve as j}from"path";import{execFile as N}from"child_process";function p(e,t,o={}){return ne...
L2: `)){let n=o.trim();if(!n||n.startsWith("ALIAS"))continue;let r=n.split(/\s{2,}/).filter(Boolean);if(r.length<2)continue;let a=r[r.length-1];if(!a.includes("@"))continue;let i=r[r.l...
High
Child Process
Package source references child process execution.
Findings
4 Critical11 High7 Medium6 Low
CriticalSame File Env Network Executiondist/chunk-IL2XLW4H.js
CriticalHardcoded Runtime Data Exfiltrationdist/chunk-SZJMS7K4.js
CriticalCommand Output Exfiltrationdist/chunk-IL2XLW4H.js
CriticalTrigger Reachable Dangerous Capabilitydist/chunk-WKMTT2UY.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/facts-4YPSHIXJ.js
HighShell
HighCredential Redirect Persistencedist/chunk-IL2XLW4H.js
HighSandbox Evasion Gated Capabilitydist/chunk-IL2XLW4H.js
HighCopied Package Dependency Bridgedist/board-dashboard-NRRYCDZW.js
HighExternal Ai Agent Control Surface Mutationdist/chunk-IL2XLW4H.js
Affected versions and remediation
This report applies to agentix-cli@0.56.0.
See all versions of agentix-cli for other recorded verdicts.
- Review the evidence and your use of agentix-cli@0.56.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.