registry / autodev-ai / 0.5.0

autodev-ai@0.5.0

AutoDev — Autonomous Engineering Team. DevTeam in a Box. Runs on pi.

AI Security Review

scanned 11d ago · by lpm-firewall-ai

No confirmed malicious attack surface is established by source inspection. The package is an autonomous developer-tool CLI with powerful user-invoked setup, update, docs, and agent-management features.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Explicit user commands such as autodev init, doctor, config, update, docs, install.sh, or uninstall.

Impact

Expected modification of AutoDev/project configuration and calls to configured provider services; no confirmed unconsented exfiltration or install-time compromise.

Mechanism

User-invoked developer automation with local config writes, package/tool installation, and provider API calls.

Rationale

The high-risk primitives are consistent with a user-invoked autonomous development CLI and installer, and no lifecycle hook or hidden import-time behavior performs credential theft, payload staging, or unconsented agent control-surface mutation. Scanner findings are mostly expected setup/update/docs features or test fixtures, so the package should not be blocked.

Evidence

package.jsonscripts/cli.tsinstall.shextensions/autodev/installer/tools.tsextensions/autodev/installer/install-module.tsextensions/autodev/installer/config-module.tsextensions/autodev/installer/uninstall-module.tsextensions/autodev/docs/seeding.tsextensions/autodev/embeddings.tsextensions/autodev/installer/key-validator.tsextensions/autodev/mcp-integrations/index.tsextensions/autodev/debug/__tests__/debug.test.ts~/.AutoDev/~/.pi/~/.autodev/~/.config/cortexkit/magic-context.jsonc~/.config/autodev.env~/.bashrc~/.zshrc~/.profile~/.config/fish/config.fish.autodev/docs-corpus/.github/ISSUE_TEMPLATE/AGENTS.mdCONTEXT.md

Network endpoints10

bun.sh/installraw.githubusercontent.com/Homebrew/install/HEAD/install.shapi.voyageai.com/v1/embeddingsollama.com/api/tagsapi.openai.com/v1/modelsapi.anthropic.com/v1/modelsgenerativelanguage.googleapis.com/v1beta/modelsdiscord.com/api/v10/users/@meapi.context7.com/v1grep.app/api

Decision evidence

public snapshot

AI called this Clean at 88.0% confidence as Benign with medium false-positive risk.

Evidence for block

scripts/cli.ts loads agent .env and exposes user-invoked update/doctor commands using execSync.
install.sh is a documented curl|bash bootstrap that installs Bun/autodev-ai and appends PI_CODING_AGENT_DIR to shell rc files.
extensions/autodev/installer/tools.ts can install system tools/package managers when invoked by install/doctor flows.
extensions/autodev/docs/seeding.ts fetches configured docs URLs or git repos and writes them to the docs corpus.
extensions/autodev/installer/uninstall-module.ts removes ~/.AutoDev, ~/.pi, ~/.autodev and project state only under explicit uninstall.

Evidence against

package.json has no preinstall/postinstall lifecycle scripts; bin is a CLI entrypoint only.
Network calls are package-aligned: LLM/key validation, embeddings, docs seeding, Context7/Grep.app tools, and npm self-update.
Secrets are prompted/configured locally in extensions/autodev/installer/config-module.ts and validated against their own providers, not sent to unrelated hosts.
Scanner secret hit in extensions/autodev/debug/__tests__/debug.test.ts is test data used to verify redaction.
AI-agent/project control files are written during explicit autodev init/config/install actions, not unconsented install-time mutation.
No evidence of credential harvesting, hidden exfiltration, persistence beyond documented config, or import-time execution.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 93 file(s), 671 KB of source, external domains: api.anthropic.com, api.context7.com, api.openai.com, api.voyageai.com, bun.sh, cli.github.com, deb.nodesource.com, discord.com, generativelanguage.googleapis.com, github.com, grep.app, ollama.com, raw.githubusercontent.com

Source & flagged code

10 flagged

extensions/autodev/debug/__tests__/debug.test.tsView file

Lines 226-267typescript

226 // The raw secret should NOT appear anywhere in the log

227 expect(content).not.toContain("sk-ant-abcdefghijklmnopqrstuvwxyz123456");

228

229 rmSync(dir, { recursive: true, force: true });

230});

231

232test("multiple secret patterns are redacted", async () => {

233 const dir = tmpDir();

234 const logPath = join(dir, "debug.log");

235 process.env.AUTODEV_DEBUG = "true";

236 process.env.AUTODEV_DEBUG_LOG = logPath;

237

238 const logger = getLogger();

239 logger.log({

240 timestamp: "t1",

241 level: "info",

242 event: "test",

243 data: {

244 anthropic: "sk-ant-abcdefghijklmnopqrstuvwxyz123456",

245 openrouter: "sk-or-abcdefghijklmnopqrstuvwxyz123456",

246 google: "AIzaSyDfi9nT6m1234567890ABCDEFGHIJKLMNOPQ",

High

Secret Pattern

Google API key in extensions/autodev/debug/__tests__/debug.test.ts

extensions/autodev/debug/__tests__/debug.test.tsView on unpkg · L246

247 github: "ghp_abcdefghijklmnopqrstuvwxyz12345678901234",

Critical

Critical Secret

Package contains a critical-looking secret pattern.

extensions/autodev/debug/__tests__/debug.test.tsView on unpkg · L247

248 slack: "xoxb-abcdefghijklmnopqrstuvwxyz1234",

249 jwt: "eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.dozjgNqPnd9dGQm4kFy8QkZ5xGc",

250 },

251 });

252

253 await new Promise((r) => setTimeout(r, 100));

254

255 const content = await readFile(logPath, "utf-8");

256 const parsed = JSON.parse(content.trim());

257

258 expect(parsed.data.anthropic).toBe("[REDACTED]");

259 expect(parsed.data.openrouter).toBe("[REDACTED]");

260 expect(parsed.data.google).toBe("[REDACTED]");

261 expect(parsed.data.github).toBe("[REDACTED]");

262 expect(parsed.data.slack).toBe("[REDACTED]");

263 expect(parsed.data.jwt).toBe("[REDACTED]");

264

265 rmSync(dir, { recursive: true, force: true });

266});

267

247patternName = github_pat severity = critical line = 247 matchedText = github: ...34",

Critical

Secret Pattern

GitHub personal access token in extensions/autodev/debug/__tests__/debug.test.ts

extensions/autodev/debug/__tests__/debug.test.tsView on unpkg · L247

extensions/autodev/background/manager.tsView file

Lines 130-170typescript

130 private maxFor(key: string): number {

131 return this.concurrencyConfig[key]?.max ?? DEFAULT_MAX_CONCURRENCY;

132 }

133

134 private running(key: string): number {

135 return this.runningPerKey.get(key) ?? 0;

extensions/autodev/docs/seeding.tsView file

Lines 174-214typescript

174 }

175

176 const destDir = join(centralCorpusRoot(), source.targetSubdir);

177 mkdirSync(destDir, { recursive: true });

178 return copyMdFiles(srcDir, destDir, source.excludePatterns, source.targetSubdir);

179 } finally {

180

extensions/autodev/installer/uninstall-module.tsView file

Lines 3-43typescript

4export interface UninstallResult {

5 readonly name: string;

6 readonly ok: boolean;

7 readonly detail: string;

extensions/autodev/embeddings.tsView file

Lines 17-57typescript

18// ---------------------------------------------------------------------------

19// Types

20// ---------------------------------------------------------------------------

22/** Injectable embedding function. Tests pass a deterministic mock. */

23export type EmbedFn = (texts: string[], isQuery?: boolean) =>

extensions/autodev/installer/tools.tsView file

Lines 1-21typescript

1import { execSync, type ExecSyncOptions } from "node:child_process";

2import { platform } from "node:os";

Critical

Download Execute

Source downloads or fetches remote code and executes it.

extensions/autodev/installer/tools.tsView on unpkg · L1

4export type Platform = "darwin" |

install.shView file

•path = install.sh kind = build_helper sizeBytes = 2692 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

Source & flagged code

10 flagged · loading source

extensions/autodev/debug/__tests__/debug.test.tsView file

247patternName = github_pat severity = critical line = 247 matchedText = github: ...34",

Critical

Critical Secret

Package contains a critical-looking secret pattern.

extensions/autodev/debug/__tests__/debug.test.tsView on unpkg · L247

247patternName = github_pat severity = critical line = 247 matchedText = github: ...34",

Critical

Secret Pattern

GitHub personal access token in extensions/autodev/debug/__tests__/debug.test.ts

extensions/autodev/debug/__tests__/debug.test.tsView on unpkg · L247

246patternName = google_api_key severity = high line = 246 matchedText = google: ...PQ",

High

Secret Pattern

Google API key in extensions/autodev/debug/__tests__/debug.test.ts

extensions/autodev/debug/__tests__/debug.test.tsView on unpkg · L246

extensions/autodev/background/manager.tsView file

150L151: spawn(config: SpawnConfig): string { L152: const id = this.nextId();

High

Child Process

Package source references child process execution.

extensions/autodev/background/manager.tsView on unpkg · L150

extensions/autodev/docs/seeding.tsView file

194const mdUrls: string[] = []; L195: let match: RegExpExecArray | null; L196: while ((match = linkRegex.exec(indexText)) !== null) {

High

Shell

Package source references shell execution.

extensions/autodev/docs/seeding.tsView on unpkg · L194

extensions/autodev/installer/uninstall-module.tsView file

181try { L182: const { execSync } = await import("node:child_process"); L183: const cmd = `npx @earendil-works/pi-coding-agent uninstall ${source}`; L184: execSync(cmd, { stdio: "pipe", timeout: 60_000, cwd: process.cwd() });

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

extensions/autodev/installer/uninstall-module.tsView on unpkg · L181

23const SHELL_RC_CANDIDATES = [ L24: ".bashrc", L25: ".zshrc", ... L55: const { notify } = deps; L56: const home = process.env.HOME ?? "~"; L57: const targets = [ ... L181: try { L182: const { execSync } = await import("node:child_process"); L183: const cmd = `npx @earendil-works/pi-coding-agent uninstall ${source}`; L184: execSync(cmd, { stdio: "pipe", timeout: 60_000, cwd: process.cwd() }); L185: notify(`Uninstalled ${source}`, "info");

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

extensions/autodev/installer/uninstall-module.tsView on unpkg · L23

extensions/autodev/embeddings.tsView file

37): Promise<Float32Array[]> { L38: const apiKey = process.env.VOYAGE_API_KEY; L39: if (!apiKey) throw new Error("VOYAGE_API_KEY not set"); ... L42: const batch = texts.slice(i, i + VOYAGE_BATCH_SIZE); L43: const res = await fetch("https://api.voyageai.com/v1/embeddings", { L44: method: "POST", ... L48: }, L49: body: JSON.stringify({ L50: model: "voyage-3", ... L55: if (!res.ok) { L56: throw new Error(`VoyageAI embeddings failed: ${res.status} ${await res.text()}`); L57: }

High

Credential Exfiltration

Source combines credential-like environment material and outbound requests; review data flow before blocking.

extensions/autodev/embeddings.tsView on unpkg · L37

extensions/autodev/installer/tools.tsView file

1import { execSync, type ExecSyncOptions } from "node:child_process"; L2: import { platform } from "node:os"; ... L59: function isNonInteractive(): boolean { L60: if (process.env.CI === "true" || process.env.CI === "1") return true; L61: if (process.stdout != null && process.stdout.isTTY === false) return true; L62: if (process.argv.includes("--yes") || process.argv.includes("-y")) return true; ... L65: L66: const HOMEBREW_BOOTSTRAP_URL = "https://raw.githubusercontent.[redacted].sh"; L67: ... L108: notify(`Installing Homebrew from ${HOMEBREW_BOOTSTRAP_URL}...`, "info"); L109: exec(`bash -c 'NONINTERACTIVE=1 /bin/bash -c "$(curl -fsSL ${HOMEBREW_BOOTSTRAP_URL})"`, { L110: stdio: "inherit",

Critical

Download Execute

Source downloads or fetches remote code and executes it.

extensions/autodev/installer/tools.tsView on unpkg · L1

install.shView file

•path = install.sh kind = build_helper sizeBytes = 2692 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

Findings

3 Critical5 High5 Medium4 Low

CriticalCritical Secretextensions/autodev/debug/__tests__/debug.test.ts

CriticalDownload Executeextensions/autodev/installer/tools.ts

CriticalSecret Patternextensions/autodev/debug/__tests__/debug.test.ts

HighChild Processextensions/autodev/background/manager.ts

HighShellextensions/autodev/docs/seeding.ts

HighCredential Exfiltrationextensions/autodev/embeddings.ts

HighRuntime Package Installextensions/autodev/installer/uninstall-module.ts

HighSecret Patternextensions/autodev/debug/__tests__/debug.test.ts

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistenceextensions/autodev/installer/uninstall-module.ts

MediumShips Build Helperinstall.sh

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

10 flagged

extensions/autodev/debug/__tests__/debug.test.tsView file

Lines 226-267typescript

226 // The raw secret should NOT appear anywhere in the log

227 expect(content).not.toContain("sk-ant-abcdefghijklmnopqrstuvwxyz123456");

228

229 rmSync(dir, { recursive: true, force: true });

230});

231

232test("multiple secret patterns are redacted", async () => {

233 const dir = tmpDir();

234 const logPath = join(dir, "debug.log");

235 process.env.AUTODEV_DEBUG = "true";

236 process.env.AUTODEV_DEBUG_LOG = logPath;

237

238 const logger = getLogger();

239 logger.log({

240 timestamp: "t1",

241 level: "info",

242 event: "test",

243 data: {

244 anthropic: "sk-ant-abcdefghijklmnopqrstuvwxyz123456",

245 openrouter: "sk-or-abcdefghijklmnopqrstuvwxyz123456",

246 google: "AIzaSyDfi9nT6m1234567890ABCDEFGHIJKLMNOPQ",

High

Secret Pattern

Google API key in extensions/autodev/debug/__tests__/debug.test.ts

extensions/autodev/debug/__tests__/debug.test.tsView on unpkg · L246

247 github: "ghp_abcdefghijklmnopqrstuvwxyz12345678901234",

Critical

Critical Secret

Package contains a critical-looking secret pattern.

extensions/autodev/debug/__tests__/debug.test.tsView on unpkg · L247

248 slack: "xoxb-abcdefghijklmnopqrstuvwxyz1234",

249 jwt: "eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.dozjgNqPnd9dGQm4kFy8QkZ5xGc",

250 },

251 });

252

253 await new Promise((r) => setTimeout(r, 100));

254

255 const content = await readFile(logPath, "utf-8");

256 const parsed = JSON.parse(content.trim());

257

258 expect(parsed.data.anthropic).toBe("[REDACTED]");

259 expect(parsed.data.openrouter).toBe("[REDACTED]");

260 expect(parsed.data.google).toBe("[REDACTED]");

261 expect(parsed.data.github).toBe("[REDACTED]");

262 expect(parsed.data.slack).toBe("[REDACTED]");

263 expect(parsed.data.jwt).toBe("[REDACTED]");

264

265 rmSync(dir, { recursive: true, force: true });

266});

267

247patternName = github_pat severity = critical line = 247 matchedText = github: ...34",

Critical

Secret Pattern

GitHub personal access token in extensions/autodev/debug/__tests__/debug.test.ts

extensions/autodev/debug/__tests__/debug.test.tsView on unpkg · L247

extensions/autodev/background/manager.tsView file

Lines 130-170typescript

130 private maxFor(key: string): number {

131 return this.concurrencyConfig[key]?.max ?? DEFAULT_MAX_CONCURRENCY;

132 }

133

134 private running(key: string): number {

135 return this.runningPerKey.get(key) ?? 0;

extensions/autodev/docs/seeding.tsView file

Lines 174-214typescript

174 }

175

176 const destDir = join(centralCorpusRoot(), source.targetSubdir);

177 mkdirSync(destDir, { recursive: true });

178 return copyMdFiles(srcDir, destDir, source.excludePatterns, source.targetSubdir);

179 } finally {

180

extensions/autodev/installer/uninstall-module.tsView file

Lines 3-43typescript

4export interface UninstallResult {

5 readonly name: string;

6 readonly ok: boolean;

7 readonly detail: string;

extensions/autodev/embeddings.tsView file

Lines 17-57typescript

18// ---------------------------------------------------------------------------

19// Types

20// ---------------------------------------------------------------------------

22/** Injectable embedding function. Tests pass a deterministic mock. */

23export type EmbedFn = (texts: string[], isQuery?: boolean) =>

extensions/autodev/installer/tools.tsView file

Lines 1-21typescript

1import { execSync, type ExecSyncOptions } from "node:child_process";

2import { platform } from "node:os";

Critical

Download Execute

Source downloads or fetches remote code and executes it.

extensions/autodev/installer/tools.tsView on unpkg · L1

4export type Platform = "darwin" |

install.shView file

•path = install.sh kind = build_helper sizeBytes = 2692 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg