registry / AI-agent capability abuse / agentix-cli / 0.63.0

agentix-cli@0.63.0

AI operations layer for small and medium businesses. Routes Telegram, WhatsApp, GitLab, GitHub, crons, webhooks, and mesh tasks to AI agents. Web wizard for operators, CLI for engineers. Self-hosted.

AI Security Review

scanned 25d ago · by lpm-firewall-ai

This is a guarded, explicit-user agent configuration capability rather than a proven malicious installation chain. Warn so downstream review can assess whether the intended Claude hook installation is acceptable.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

A user runs the attach install command or setup flow.

Impact

A user-authorized configuration change can affect future AI-agent sessions and therefore merits a capability warning.

Mechanism

The command modifies the selected Claude settings file to add hooks; setup writes an agent workspace configuration.

AI rationale

Evidence

dist/chunk-7LETLAIH.jsdist/chunk-33YJIUYL.js.claude/settings.jsonagentx.jsonagents/<agent-id>/CLAUDE.md

Network endpoints1

api.anthropic.com/v1/messages

Decision evidence

public snapshot

AI called this Suspicious at 88.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

An explicit attach install command patches Claude user settings with hooks.
The hook installer preserves existing JSON and appends package-defined hook entries.
The setup flow creates an agent workspace and CLAUDE.md.
The install hook is limited to a local better-sqlite3 rebuild path.
Model requests go to Anthropic's fixed API endpoint.

Evidence against

No unconsented agent-control mutation was found in the npm lifecycle hook.
No concrete credential export, remote payload execution, or destructive broad filesystem action was identified.

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationUrlStrings

ManifestNo manifest risk signals triggered.

scanned 140 file(s), 3.91 MB of source, external domains: 100.64.0.11, 100.x.x.x, 127.0.0.1, 192.168.1.50, api.anthropic.com, api.context7.com, api.deepseek.com, api.elevenlabs.io, api.example.com, api.github.com, api.openai.com, api.telegram.org, api.typesafe.ai, claude.ai, console.anthropic.com, docs.anthropic.com, docs.claude.com, example.com, fonts.googleapis.com, fonts.gstatic.com, github.com, gitlab.com, gitlab.example.com, host.example.ts.net, my-mac.tailnet-name.ts.net, ntfy.sh, opencode.ai, openrouter.ai, peer.example.com, pro.reactflow.dev, raw.githubusercontent.com, reactflow.dev, reactjs.org, status.anthropic.com, t.me, unpkg.com, wacli.sh, www.apple.com, www.w3.org, x.com, x.tld

Source & flagged code

20 flagged

package.jsonView file

Lines 56-96json

56 "build": "tsup && tsup --config tsup.web.config.ts",

57 "build:web": "tsup --config tsup.web.config.ts",

58 "dev": "tsup --watch",

59 "typecheck": "tsc --noEmit",

60 "bench:context": "tsx bench/context-size.ts",

61 "test": "vitest run",

62 "clean": "rimraf dist",

63 "format:write": "prettier --write \"src/**/*.{ts,tsx,mdx}\" --cache",

64 "format:check": "prettier --check \"src/**/*.{ts,tsx,mdx}\" --cache",

65 "eval": "vitest run test/eval/",

66 "eval:track": "TRACK_SCORES=1 vitest run test/eval/real-data-eval.test.ts",

67 "usage:track": "tsx src/scripts/track-usage.ts",

68 "docs:dev": "vitepress dev docs",

69 "docs:build": "vitepress build docs",

70 "docs:check": "node docs/.scripts/check-sidebar.mjs && vitepress build docs",

71 "docs:demo": "node dist/cli.js demo --no-open --keep",

72 "docs:seed": "node docs/.scripts/seed-demo.mjs",

73 "docs:shots": "node docs/.scripts/capture.mjs",

74 "docs:preview": "vitepress preview docs",

75 "prepublishOnly": "npm run build",

76 "postinstall": "node scripts/postinstall.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L76

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L76

77 },

78 "dependencies": {

79 "@roamhq/wrtc": "^0.10.0",

80 "@types/better-sqlite3": "^7.6.13",

81 "@types/js-yaml": "^4.0.9",

82 "@whiskeysockets/baileys": "7.0.0-rc.9",

83 "@xyflow/react": "^12.10.2",

84 "better-sqlite3": "^12.9.0",

85 "chalk": "5.2.0",

86 "cli-highlight": "^2.1.11",

87 "commander": "^10.0.0",

88 "cosmiconfig": "^8.1.3",

89 "cronstrue": "^3.14.0",

90 "execa": "^7.0.0",

91 "fast-glob": "^3.3.2",

92 "fs-extra": "^11.2.0",

93 "ink": "^5.0.1",

94 "js-yaml": "^4.1.1",

95 "jsqr": "^1.4.0",

96 "marked": "^15.0.12",

dist/facts-4YPSHIXJ.jsView file

Lines 1-21javascript

1import"./chunk-QIJLFPWE.js";import{existsSync as E,readFileSync as T}from"fs";import{resolve as j}from"path";import{execFile as N}from"child_process";function p

dist/chunk-ZGWW6FZF.jsView file

20L21: `)}`}]}:{content:[{type:"text",text:"No matching skills found. Install skills with: agentx skill install <owner/repo>"}]}}case"agentx_detect_output_type":{let n=e.task;return{conte... L22: `)}]}}case"agentx_send_contact":{let n=e.contactName,s=e.text,i=e.channel,o=e.confirmed===!0,a=e.agentId;if(!n||!s)return{content:[{type:"text",text:"Error: contactName and text ar... ... L30: Citations (${m} article${m===1?"":"s"} walked): L31: ${b}`}]}}case"agentx_wiki_patch":{let n=String(e.agent||"").trim(),s=String(e.title_or_path||"").trim(),i=String(e.instruction||"").trim();if(!n||!s||!i)return{content:[{type:"text... L32: ${[d.stdout,d.stderr,d.message].filter(Boolean).map(g=>_e(String(g))).join(` L33: `).trim().slice(0,2e3)}`}]}}}case"agentx_wiki_interview":{let n=String(e.agent||"")

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

dist/chunk-ZGWW6FZF.jsView on unpkg · L20

20Trigger-reachable chain: manifest.main -> dist/index.js -> dist/chunk-ZGWW6FZF.js L20: L21: `)}`}]}:{content:[{type:"text",text:"No matching skills found. Install skills with: agentx skill install <owner/repo>"}]}}case"agentx_detect_output_type":{let n=e.task;return{conte... L22: `)}]}}case"agentx_send_contact":{let n=e.contactName,s=e.text,i=e.channel,o=e.confirmed===!0,a=e.agentId;if(!n||!s)return{content:[{type:"text",text:"Error: contactName and text ar... ... L30: Citations (${m} article${m===1?"":"s"} walked): L31: ${b}`}]}}case"agentx_wiki_patch":{let n=String(e.agent||"").trim(),s=String(e.title_or_path||"").trim(),i=String(e.instruction||"").trim();if(!n||!s||!i)return{content:[{type:"text... L32: ${[d.stdout,d.stderr,d.message].filter(Boolean).map(g=>_e(String(g))).join(` L33: `

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/chunk-ZGWW6FZF.jsView on unpkg · L20

dist/chunk-PMGPGMBZ.jsView file

Lines 1-19javascript

1import{b as Ce,c as Me}from"./chunk-WP6KLXTP.js";import{a as ee}from"./chunk-N6EWZGIX.js";import{b as Oe,e as We,f as je,i as Ee,k as Fe,l as

dist/chunk-7LETLAIH.jsView file

Lines 1-21javascript

1import{a as Nc,b as Hn,g as Rc}from"./chunk-5WMHW4A6.js";import{a as xc,c as Sc}from"./chunk-N42YWYIR.js";import{a as ao,b as bc,f as $c,g as

dist/chunk-5UYXEO3I.jsView file

Lines 1-21javascript

1import{g as ze,h as He,i as Ke,k as Ge,l as Xe}from"./chunk-I2SD4XZ6.js";import{t as Ye,u as Ze}from"./chunk-XT3E5MLX.js";import{d as qe,e as

dist/board-dashboard-SMCZBJKO.jsView file

4765package = agentix-cli; repositoryIdentity = agentx; dependency = cronstrue L4765: ${s||"You are "+a+"."} L4766: `)}catch{}return{summary:l}}function cs(t){let e=String(t?.id||"").trim();if(!e)throw new Error("Agent id is required.");let a=t?.patch||{},{summary:n}=C(r=>{if(!r.agents?.[e])thro... L4767: `,"utf-8");try{let s=Q().dashboard.daemonUrl?.replace(/\/+$/,"")||"http://127.0.0.1:18800";fetch(`${s}/reload`,{method:"POST"}).catch(()=>null)}catch{}return{summary:"agentx.json r...

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/board-dashboard-SMCZBJKO.jsView on unpkg · L4765

dist/chunk-TX3ZOO22.jsView file

12Trigger-reachable command-output exfiltration chain: manifest.main -> dist/index.js -> dist/chunk-TX3ZOO22.js L12: L13: `)}import Je from"node-fetch";var Ke="https://api.context7.com/v1";async function vt(r,e){try{let t={"Content-Type":"application/json"};e&&(t.Authorization=`Bearer ${e}`);let o=awa... L14: ${a}`)}}return s.length?`# Relevant Library Documentation (via Context7) ... L19: L20: `)}`:""}var Ye={component:{type:"component",baseDir:"src/components",filePatterns:["*.tsx","*.vue","*.svelte","*.jsx","*.ts"],description:"UI component"},page:{type:"page",baseDir:... L21: `)}ke();var oe=class{hooks=new Map;register(e,t){if(!t.enabled)return;let o=this.createHandler(t),n={event:e,definition:t,handler:o},s=this.hooks.get(e)||[];s.push(n),s.sort((i,c)=... L22:

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/chunk-TX3ZOO22.jsView on unpkg · L12

apps/mac-helper/build.shView file

•path = apps/mac-helper/build.sh kind = build_helper sizeBytes = 2445 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

apps/mac-helper/build.shView on unpkg

dist/chunk-33YJIUYL.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 7

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/chunk-33YJIUYL.js#virtual:normalized:round1View on unpkg

Source & flagged code

20 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/facts-4YPSHIXJ.jsView file

1import"./chunk-QIJLFPWE.js";import{existsSync as E,readFileSync as T}from"fs";import{resolve as j}from"path";import{execFile as N}from"child_process";function p(e,t,o={}){return ne... L2: `)){let n=o.trim();if(!n||n.startsWith("ALIAS"))continue;let r=n.split(/\s{2,}/).filter(Boolean);if(r.length<2)continue;let a=r[r.length-1];if(!a.includes("@"))continue;let i=r[r.l...

High

Child Process

Package source references child process execution.

Findings

5 Critical11 High7 Medium6 Low

CriticalSame File Env Network Executiondist/chunk-7LETLAIH.js

CriticalHardcoded Runtime Data Exfiltrationdist/chunk-5UYXEO3I.js

CriticalCommand Output Exfiltrationdist/chunk-ZGWW6FZF.js

CriticalTrigger Reachable Dangerous Capabilitydist/chunk-ZGWW6FZF.js

CriticalPrevious Version Dangerous Deltadist/chunk-7LETLAIH.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/facts-4YPSHIXJ.js

HighShell

HighCredential Redirect Persistencedist/chunk-7LETLAIH.js

HighSandbox Evasion Gated Capabilitydist/chunk-7LETLAIH.js

HighCopied Package Dependency Bridgedist/board-dashboard-SMCZBJKO.js

Affected versions and remediation

This report applies to agentix-cli@0.63.0.

See all versions of agentix-cli for other recorded verdicts.

Review the evidence and your use of agentix-cli@0.63.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-28 11:02:48.069Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code