autopilot-ai@1.11.0
autopilot (formerly kimiflare): a terminal coding agent that runs any OpenRouter model with your own key. Per-turn billed cost, web search, GitHub, headless browser, LSP, MCP, local memory.
AI Security Review
scanned 1mo ago · by lpm-firewall-aiInspected source supports an explicit user-command capability to modify project agent instructions, which warrants a warning under the supplied policy. No concrete malicious behavior supporting a publication block was identified.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
The user invokes /init in the CLI.
Impact
Generated instructions can change subsequent agent behavior within the project.
Mechanism
The command submits a generation prompt to the agent using filesystem tools and a permission callback, then reloads the resulting project context.
AI rationale
Inspected source supports an explicit user-command capability to modify project agent instructions, which warrants a warning under the supplied policy. No concrete malicious behavior supporting a publication block was identified.
Evidence
dist/index.jsAGENTS.mdKIMI.mdKIMIFLARE.mdAGENT.md
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- package.json has no install lifecycle hooks or runtime self-dependency.
- Both flagged locations define project instruction filenames with a 20 KiB context limit.
- The SDK exposes a separately configured custom endpoint and optional endpoint credential.
- The explicit /init command starts a model turn to generate or refresh project agent instructions.
- The initialization turn passes a user permission callback for tool execution.
- Project instruction content enters the assistant prompt as authoritative context.
Evidence against
- Agent instruction generation requires the explicit /init command rather than npm installation.
- Custom endpoint requests use the endpoint credential rather than an existing provider session.
- No covert export, unconsented install mutation, or malicious payload execution was identified.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindings
Source & flagged code
13 flaggeddist/index.jsView file
59function defaultLogDir() {
L60: const xdg = process.env.XDG_CONFIG_HOME || join(homedir(), ".config");
L61: return join(xdg, "kimiflare", "logs");
...
L76: if (currentStream) {
L77: currentStream.end();
L78: currentStream = null;
...
L195: function setFetchForTesting(f) {
L196: fetchImpl = f ?? ((url, init) => fetch(url, init));
L197: }
...
L642: const raw = await readFile(configPath(), "utf8");
L643: persisted = JSON.parse(raw);
L644: hasFile = true;
Critical
Remote Response Code Execution
Source passes code obtained from a remote response into a dynamic execution sink.
dist/index.jsView on unpkg · L59•matchType = previous_version_dangerous_delta
matchedPackage = autopilot-ai@1.4.0
matchedIdentity = npm:YXV0b3BpbG90LWFp:1.4.0
similarity = 0.600
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/index.jsView on unpkg1122// src/remote/deploy.ts
L1123: import { execSync } from "child_process";
L1124: import { join as join7, dirname as dirname4 } from "path";
High
Findings
2 Critical11 High4 Medium5 Low
CriticalRemote Response Code Executiondist/index.js
CriticalPrevious Version Dangerous Deltadist/index.js
HighChild Processdist/index.js
HighShelldist/index.js
HighEval
HighSame File Env Network Executiondist/sdk/index.js
HighCredential Redirect Persistencedist/index.js
HighCommand Output Exfiltrationdist/sdk/index.js
HighObfuscated Payload Loaderdist/index.js
HighRemote Agent Bridgedist/index.js
HighCross File Remote Execution Contextdist/index.js
HighTrigger Reachable Command Output Exfiltrationdist/sdk/index.js
Affected versions and remediation
This report applies to autopilot-ai@1.11.0.
See all versions of autopilot-ai for other recorded verdicts.
- Review the evidence and your use of autopilot-ai@1.11.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.