registry / autokap / 2.0.1

autokap@2.0.1

AI-powered CLI tool for capturing clean screenshots of websites

AI Security Review

scanned 19h ago · by lpm-firewall-ai

No confirmed malicious attack surface. Network, browser automation, artifact uploads, and subprocesses are tied to the advertised screenshot-capture CLI and explicit runtime actions.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User runs `autokap run`, `doctor --fix`, or accepts an interactive update prompt.

Impact

Captures requested web content and uploads requested artifacts to the configured AutoKap service; no unsolicited credential harvesting, foreign agent mutation, or install-time execution found.

Mechanism

Playwright capture, service API upload, optional Chromium install, and user-approved CLI update.

Rationale

Source inspection found a normal automation CLI with user-invoked network and subprocess behavior. The scanner signals are explained by explicit runtime features; no malicious chain or AI-agent control-surface mutation was found.

Evidence

package.jsondist/cli.jsdist/cli-runner.jsdist/playwright-installer.jsdist/cli-updater.jsdist/cli-config.jsdist/cookie-dismiss.js~/.autokap/config.json~/.autokap/last-update-check.jsontemporary audio filesuser-selected output directory

Network endpoints5

autokap.appwss://autokap.app/wsregistry.npmjs.org/autokap/latestopenrouter.ai/api/v1eu.i.posthog.com

Decision evidence

public snapshot

AI called this Clean at 93.0% confidence as Benign with low false-positive risk.

Evidence for block

Evidence against

`package.json` has no lifecycle scripts; install/import do not trigger package code.
`dist/cli.js` runs only as the `autokap` executable and exposes explicit login/run/doctor commands.
`dist/playwright-installer.js` downloads Chromium only during a capture run when missing.
`dist/cli-updater.js` checks `registry.npmjs.org` only in an interactive CLI session and runs global npm install after a prompt.
`dist/cli-config.js` stores only AutoKap CLI config in `~/.autokap` with restrictive permissions and validates origins.
`dist/cookie-dismiss.js` uses `new Function` only inside the Playwright page to reconstruct its own cookie-container predicate.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 95 file(s), 1.63 MB of source, external domains: app.example.com, autokap.app, eu.i.posthog.com, example.com, ffmpeg.org, github.com, nodejs.org, openrouter.ai, registry.npmjs.org, www.google.com, www.w3.org

Source & flagged code

7 flagged

dist/openrouter-tts.jsView file

Lines 1-33javascript

1/**

2 * AUT-57 — OpenRouter TTS client.

3 *

4 * Posts a single chunk of narration text to OpenRouter's `/audio/speech`

5 * endpoint (mirrors the OpenAI shape) and returns the audio buffer + measured

6 * duration. Word-level timestamps are NOT returned by this provider; the

7 * caller derives per-word timings separately for animated subtitles.

8 *

9 * The default model is `openai/gpt-4o-mini-tts` (chosen in the AUT-57 plan as

10 * the V1 baseline — good EN voices, OpenRouter-billed). Override via the

11 * caller if a benchmark identifies a better trade-off.

12 *

13 * **Pure module** — no Node-only imports beyond `node:fs` / `node:os` /

14 * `node:path` / `node:child_process` (used only for duration probing). Safe

15 * to import from both the CLI and the Next.js server runtime.

High

Child Process

Package source references child process execution.

dist/openrouter-tts.jsView on unpkg · L13

16 */

17import { execFile } from 'node:child_process';

18import { promises as fs } from 'node:fs';

19import os from 'node:os';

20import path from 'node:path';

21import { promisify } from 'node:util';

22const execFileAsync = promisify(execFile);

23const OPENROUTER_BASE_URL = 'https://openrouter.ai/api/v1';

24/**

25 * Default TTS model. Matches the exact slug listed under

26 * `GET /models?output_modalities=speech` (April 2026):

27 * - openai/gpt-4o-mini-tts-2025-12-15

28 * - mistralai/voxtral-mini-tts-2603

29 * - google/gemini-3.1-flash-tts-preview

30 * - hexgrad/kokoro-82m, sesame/csm-1b, zyphra/zonos-*, canopylabs/orpheus-*

31 *

32 * gpt-4o-mini-tts ranks well on EN voice quality and is the AUT-57 baseline.

33 * The PR #3 spec explicitly calls it out — pivot per benchmark in PR #4 if

dist/cookie-dismiss.jsView file

Lines 167-207javascript

167 await button.click({ timeout: 2000 });

168 logger.info(`Cookie dismissed via CMP selector: ${selector}`);

169 await page.waitForTimeout(500);

170 await ensureCaptureHideStyles(page);

171 return { dismissed: true

dist/capture-variant-state.jsView file

Lines 1-21javascript

1import { createHash } from "crypto";

2import { inferCapturePageIdentity } from "./capture-page-identity.js";

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/capture-variant-state.jsView on unpkg · L1

3function normalizePageId(pageId) {

4 return pageId ?? "main";

dist/cli-updater.jsView file

Lines 1-37javascript

1// Self-update prompt for the bundled `autokap` CLI.

2//

3// Runs once per command, before Commander parses argv. Best-effort and

4// fail-open: any error, network timeout, or unexpected state silently skips

5// the prompt — the user's command must never be blocked by this check.

6//

7// Behavior summary:

8// - Skipped entirely when stdin/stdout is not a TTY, CI=1 is set, the current

9// version is a pre-release, the CLI was invoked via `npx` cache, or argv

10// contains only --version/--help (read-only commands).

11// - Fetches the latest version from the npm registry with a 2s hard timeout.

dist/posthog.jsView file

Lines 1-24javascript

1import { PostHog } from 'posthog-node';

2import { createHash } from 'node:crypto';

3import { hostname } from 'node:os';

4// Stable anonymous ID derived from machine hostname — no PII collected

5const machineId = createHash('sha256').update(hostname

dist/playwright-installer.jsView file

Lines 1-31javascript

1/**

2 * Preflight Playwright Chromium binary install.

3 *

4 * Run before any `chromium.launch(...)` to make sure the Playwright Chromium

5 * binary exists on disk. The package ships a `postinstall` hook that fetches

6 * Chromium at install time, but that step can be silently skipped on some

7 * setups (CI caches, monorepos, npm scripts) — and any Playwright version

8 * bump downstream invalidates the existing binary too. Catching this once at

9 * run start avoids the famously confusing "Executable doesn't exist at …"

10 * launch failure mid-capture.

11 *

dist/cli.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = autokap@1.9.10 matchedIdentity = npm:YXV0b2thcA:1.9.10 similarity = 0.905 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli.jsView on unpkg

Source & flagged code

7 flagged · loading source

dist/openrouter-tts.jsView file

13* **Pure module** — no Node-only imports beyond `node:fs` / `node:os` / L14: * `node:path` / `node:child_process` (used only for duration probing). Safe L15: * to import from both the CLI and the Next.js server runtime.

High

Child Process

Package source references child process execution.

dist/openrouter-tts.jsView on unpkg · L13

dist/cookie-dismiss.jsView file

187// eslint-disable-next-line no-new-func L188: const isCookieConsentContainer = new Function(`return (${predicateSource})`)(); L189: // Find all visible buttons and links

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/cookie-dismiss.jsView on unpkg · L187

dist/capture-variant-state.jsView file

1import { createHash } from "crypto"; L2: import { inferCapturePageIdentity } from "./capture-page-identity.js";

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/capture-variant-state.jsView on unpkg · L1

dist/cli-updater.jsView file

17// against the new binary. L18: import { spawn } from 'node:child_process'; L19: import fs from 'node:fs/promises'; L20: import https from 'node:https'; L21: import path from 'node:path'; ... L32: function isInteractive() { L33: return Boolean(process.stdout.isTTY && process.stdin.isTTY && !process.env.CI); L34: }

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli-updater.jsView on unpkg · L17

dist/posthog.jsView file

4// Stable anonymous ID derived from machine hostname — no PII collected L5: const machineId = createHash('sha256').update(hostname()).digest('hex').slice(0, 16); L6: export const DISTINCT_ID = `cli-${machineId}`; ... L10: if (!_client) { L11: _client = new PostHog(process.env.POSTHOG_API_KEY ?? '', { L12: host: process.env.POSTHOG_HOST ?? 'https://eu.i.posthog.com', L13: flushAt: 1,

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/posthog.jsView on unpkg · L4

dist/playwright-installer.jsView file

11* L12: * Cross-platform: uses `npx playwright install chromium` (works on macOS, L13: * Linux, Windows). Output is streamed inherit so the user sees the ... L15: */ L16: import { spawn } from 'node:child_process'; L17: import { existsSync } from 'node:fs';

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/playwright-installer.jsView on unpkg · L11

dist/cli.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli.jsView on unpkg

Findings

1 Critical5 High3 Medium6 Low

CriticalPrevious Version Dangerous Deltadist/cli.js

HighChild Processdist/openrouter-tts.js

HighShell

HighSame File Env Network Executiondist/cli-updater.js

HighSandbox Evasion Gated Capabilitydist/posthog.js

HighRuntime Package Installdist/playwright-installer.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowEvaldist/cookie-dismiss.js

LowWeak Cryptodist/capture-variant-state.js

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

Source & flagged code

7 flagged

dist/openrouter-tts.jsView file

Lines 1-33javascript

1/**

2 * AUT-57 — OpenRouter TTS client.

3 *

4 * Posts a single chunk of narration text to OpenRouter's `/audio/speech`

5 * endpoint (mirrors the OpenAI shape) and returns the audio buffer + measured

6 * duration. Word-level timestamps are NOT returned by this provider; the

7 * caller derives per-word timings separately for animated subtitles.

8 *

9 * The default model is `openai/gpt-4o-mini-tts` (chosen in the AUT-57 plan as

10 * the V1 baseline — good EN voices, OpenRouter-billed). Override via the

11 * caller if a benchmark identifies a better trade-off.

12 *

13 * **Pure module** — no Node-only imports beyond `node:fs` / `node:os` /

14 * `node:path` / `node:child_process` (used only for duration probing). Safe

15 * to import from both the CLI and the Next.js server runtime.

High

Child Process

Package source references child process execution.

dist/openrouter-tts.jsView on unpkg · L13

16 */

17import { execFile } from 'node:child_process';

18import { promises as fs } from 'node:fs';

19import os from 'node:os';

20import path from 'node:path';

21import { promisify } from 'node:util';

22const execFileAsync = promisify(execFile);

23const OPENROUTER_BASE_URL = 'https://openrouter.ai/api/v1';

24/**

25 * Default TTS model. Matches the exact slug listed under

26 * `GET /models?output_modalities=speech` (April 2026):

27 * - openai/gpt-4o-mini-tts-2025-12-15

28 * - mistralai/voxtral-mini-tts-2603

29 * - google/gemini-3.1-flash-tts-preview

30 * - hexgrad/kokoro-82m, sesame/csm-1b, zyphra/zonos-*, canopylabs/orpheus-*

31 *

32 * gpt-4o-mini-tts ranks well on EN voice quality and is the AUT-57 baseline.

33 * The PR #3 spec explicitly calls it out — pivot per benchmark in PR #4 if

dist/cookie-dismiss.jsView file

Lines 167-207javascript

167 await button.click({ timeout: 2000 });

168 logger.info(`Cookie dismissed via CMP selector: ${selector}`);

169 await page.waitForTimeout(500);

170 await ensureCaptureHideStyles(page);

171 return { dismissed: true

dist/capture-variant-state.jsView file

Lines 1-21javascript

1import { createHash } from "crypto";

2import { inferCapturePageIdentity } from "./capture-page-identity.js";

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/capture-variant-state.jsView on unpkg · L1

3function normalizePageId(pageId) {

4 return pageId ?? "main";

dist/cli-updater.jsView file

Lines 1-37javascript

1// Self-update prompt for the bundled `autokap` CLI.

2//

3// Runs once per command, before Commander parses argv. Best-effort and

4// fail-open: any error, network timeout, or unexpected state silently skips

5// the prompt — the user's command must never be blocked by this check.

6//

7// Behavior summary:

8// - Skipped entirely when stdin/stdout is not a TTY, CI=1 is set, the current

9// version is a pre-release, the CLI was invoked via `npx` cache, or argv

10// contains only --version/--help (read-only commands).

11// - Fetches the latest version from the npm registry with a 2s hard timeout.

dist/posthog.jsView file

Lines 1-24javascript

1import { PostHog } from 'posthog-node';

2import { createHash } from 'node:crypto';

3import { hostname } from 'node:os';

4// Stable anonymous ID derived from machine hostname — no PII collected

5const machineId = createHash('sha256').update(hostname

dist/playwright-installer.jsView file

Lines 1-31javascript

1/**

2 * Preflight Playwright Chromium binary install.

3 *

4 * Run before any `chromium.launch(...)` to make sure the Playwright Chromium

5 * binary exists on disk. The package ships a `postinstall` hook that fetches

6 * Chromium at install time, but that step can be silently skipped on some

7 * setups (CI caches, monorepos, npm scripts) — and any Playwright version

8 * bump downstream invalidates the existing binary too. Catching this once at

9 * run start avoids the famously confusing "Executable doesn't exist at …"

10 * launch failure mid-capture.

11 *

dist/cli.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli.jsView on unpkg