registry / autopilot-ai / 1.2.0
autopilot-ai@1.2.0
autopilot (formerly kimiflare): a terminal coding agent that runs any OpenRouter model with your own key. Per-turn billed cost, web search, GitHub, headless browser, LSP, MCP, local memory.
AI Security Review
scanned 1mo ago · by lpm-firewall-aiautopilot-ai 1.2.0 is a user-invoked terminal coding agent whose entrypoints and OpenRouter client match that product purpose. Install scripts, self-dependencies, and hidden credential export are absent from the inspected package metadata and entry files.
Static reason
One or more suspicious static signals were detected.
Trigger
User invocation of the autopilot binary or an explicit SDK call.
Impact
No unconsented credential theft, remote payload execution, or foreign agent-control mutation was established from the inspected entrypoints.
Mechanism
The CLI loads dist/index.js and calls OpenRouter with a key the user supplies. There is no registry install hook and no self-install chain.
AI rationale
autopilot-ai 1.2.0 is a user-invoked terminal coding agent whose entrypoints and OpenRouter client match that product purpose. Install scripts, self-dependencies, and hidden credential export are absent from the inspected package metadata and entry files.
Network endpoints1
openrouter.ai/api/v1
Decision evidence
public snapshotAI called this Clean at 86.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json exposes a user-run autopilot binary and library exports, with no preinstall, install, or postinstall hook.
- Scripts are build, dev, test, and prepublishOnly build only; the package does not depend on its own name.
- dist/index.js sends model traffic to the OpenRouter API using the caller-supplied key.
- dist/sdk/index.js uses the same OpenRouter default base URL.
- bin/autopilot.mjs only imports dist/index.js when the user launches the CLI.
Evidence against
- child_process and isolated-vm eval appear in agent tool and sandbox code that runs after the user starts the CLI, not at install time.
- A feedback URL is opened only from an explicit in-app voice-note command and does not send the API key.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShell
Source & flagged code
8 flaggeddist/index.jsView file
688// src/remote/deploy.ts
L689: import { execSync } from "child_process";
L690: import { join as join6, dirname as dirname4 } from "path";
High
6152if (lower === "cmd") {
L6153: return { shell: process.env.COMSPEC || "cmd.exe", args: ["/c"], isPosix: false };
L6154: }
High
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/index.js:
import { readFile, mkdir, writeFile, chmod } from "fs/promises";
const baseUrl = process.env.KIMIFLARE_BASE_URL ?? persisted.baseUrl;
if (!openrouterApiKey && !baseUrl) return null;
baseUrl,
await writeFile(p, JSON.stringify(next, null, 2), "utf8");
await writeFile(p, JSON.stringify(merged, null, 2), "utf8");
await writeFile(p, JSON.stringify(cfg, null, 2), "utf8");
import { readFile as readFile2, mkdir as mkdir2, writeFile as writeFile2 } from "fs/promises";
High
Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
Findings
7 High4 Medium6 Low
HighChild Processdist/index.js
HighShelldist/index.js
HighSame File Env Network Executiondist/sdk/index.js
HighCredential Redirect Persistencedist/index.js
HighObfuscated Payload Loaderdist/index.js
HighRemote Agent Bridgedist/index.js
HighCross File Remote Execution Contextdist/index.js
MediumDynamic Requiredist/index.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEval
LowFilesystem
Affected versions and remediation
This report applies to autopilot-ai@1.2.0.
See all versions of autopilot-ai for other recorded verdicts.
- Review the evidence and your use of autopilot-ai@1.2.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.