ambiguous@0.9.9
CLI for Ambiguous Workspace — manage docs, tasks, mail, calendar, CRM, and more from the terminal
AI Security Review
scanned 14d ago · by lpm-firewall-aiThe bundle accepts arbitrary environment or saved API URLs and forwards the saved token without a visible destination allowlist, which warrants a warning for conditional credential exposure. The package defaults to its own API and the inspected source does not establish a fixed third-party recipient or covert transfer.
Static reason
No blocking static signals were detected.
Trigger
A user runs an authenticated CLI command while AMBI_API_URL or saved API URL configuration points to a non-Ambiguous endpoint.
Impact
Conditional exposure of the saved service credential to the configured endpoint; no evidence establishes covert theft or malicious intent.
Mechanism
The request layer selects the configured URL, creates the request there, and adds the saved token as a Bearer authorization header; authentication also persists a non-default URL alongside the credential.
AI rationale
The bundle accepts arbitrary environment or saved API URLs and forwards the saved token without a visible destination allowlist, which warrants a warning for conditional credential exposure. The package defaults to its own API and the inspected source does not establish a fixed third-party recipient or covert transfer.
Evidence
dist/index.js.ambi/config.json
Network endpoints2
api.ambiguous.aiAMBI_API_URL-configured endpoint
Decision evidence
public snapshotAI called this Suspicious at 87.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The published CLI entrypoint loads the distribution bundle.
- The API URL can come from an environment variable or saved local/global config without a visible host allowlist.
- The request layer builds requests to that URL and attaches the saved bearer token.
- Authentication saves the API URL with the credential, so later CLI requests can reuse that destination.
Evidence against
- The default production API is api.ambiguous.ai, and the reviewed sign-in flow exchanges credentials with the selected API URL.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsUrlStrings
NoLicenseWildcardDependency
Source & flagged code
3 flaggeddist/index.jsView file
49* Constructs the CommanderError class
L50: * @param {number} exitCode suggested exit code which could be used with process.exit
L51: * @param {string} code an id string representing the error
...
L1164: var EventEmitter = __require("events").EventEmitter;
L1165: var childProcess2 = __require("child_process");
L1166: var path12 = __require("path");
...
L1214: this._outputConfiguration = {
L1215: writeOut: (str) => process15.stdout.write(str),
L1216: writeErr: (str) => process15.stderr.write(str),
...
L1253: * @returns {Command[]}
L1254: * @private
L1255: */
High
Browser Session Account Hijack
Browser source reuses an authenticated session to collect identity data and mutate account settings while reporting externally.
dist/index.jsView on unpkg · L49•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/index.js:
trigger: "a person approves an OAuth client on the consent screen and its authorization code is written",
API_KEY_CREATED = "API Key Created";
{ event: API_KEY_CREATED, module: "admin", owner: "platform", properties: [], ppiPosture: "none", description: "An API key was created" },
writeFile: retryify_async_default(promisify(fs.writeFile), RETRYIFY_OPTIONS),
writeFileSync: retryify_sync_default(fs.writeFileSync, RETRYIFY_OPTIONS)
function writeFileSync(filePath, data, options = DEFAULT_WRITE_OPTIONS) {
return writeFileSync(filePath, data, { encoding: options });
fs2.writeFileSync(this.path, data, { mode: this.#options.con
High
Credential Redirect Persistence
Findings
2 High3 Medium7 Low
HighBrowser Session Account Hijackdist/index.js
HighCredential Redirect Persistencedist/index.js
MediumNetwork
MediumEnvironment Vars
MediumWildcard Dependency
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvaldist/index.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to ambiguous@0.9.9.
See all versions of ambiguous for other recorded verdicts.
- Review the evidence and your use of ambiguous@0.9.9 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.