registry / autopilot-ai / 1.2.1
autopilot-ai@1.2.1
autopilot (formerly kimiflare): a terminal coding agent that runs any OpenRouter model with your own key. Per-turn billed cost, web search, GitHub, headless browser, LSP, MCP, local memory.
AI Security Review
scanned 1mo ago · by lpm-firewall-aiInstall metadata has no lifecycle hook that mutates a foreign agent surface, and the AGENTS.md read is ordinary project skill discovery after the user starts the CLI. Network and process use elsewhere matches a user-invoked coding agent rather than an install payload.
Static reason
One or more suspicious static signals were detected.
Trigger
The user runs the autopilot command or calls the SDK.
Impact
No unconsented credential theft, persistence, or foreign agent-config mutation was established.
Mechanism
Skill discovery reads markdown under the current project, including AGENTS.md, and indexes it for the agent session.
AI rationale
Install metadata has no lifecycle hook that mutates a foreign agent surface, and the AGENTS.md read is ordinary project skill discovery after the user starts the CLI. Network and process use elsewhere matches a user-invoked coding agent rather than an install payload.
Decision evidence
public snapshotAI called this Clean at 86.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json scripts are build, dev, test, start, and prepublishOnly, with no preinstall, install, or postinstall hook.
- dist/index.js discoverSkills only checks the current project for .agents/skills and AGENTS.md after the agent runs.
- dist/sdk/index.js exports session, config, and RPC helpers and does not register an install lifecycle.
Evidence against
- The bin entry only imports dist/index.js when the user launches the autopilot command.
- There is no runtime self-dependency and no install-time write to a foreign agent control surface.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
8 flaggeddist/index.jsView file
688// src/remote/deploy.ts
L689: import { execSync } from "child_process";
L690: import { join as join6, dirname as dirname4 } from "path";
High
6152if (lower === "cmd") {
L6153: return { shell: process.env.COMSPEC || "cmd.exe", args: ["/c"], isPosix: false };
L6154: }
High
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/index.js:
import { readFile, mkdir, writeFile, chmod } from "fs/promises";
const baseUrl = process.env.KIMIFLARE_BASE_URL ?? persisted.baseUrl;
if (!openrouterApiKey && !baseUrl) return null;
baseUrl,
await writeFile(p, JSON.stringify(next, null, 2), "utf8");
await writeFile(p, JSON.stringify(merged, null, 2), "utf8");
await writeFile(p, JSON.stringify(cfg, null, 2), "utf8");
import { readFile as readFile2, mkdir as mkdir2, writeFile as writeFile2 } from "fs/promises";
High
Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
Findings
7 High4 Medium6 Low
HighChild Processdist/index.js
HighShelldist/index.js
HighSame File Env Network Executiondist/sdk/index.js
HighCredential Redirect Persistencedist/index.js
HighObfuscated Payload Loaderdist/index.js
HighRemote Agent Bridgedist/index.js
HighCross File Remote Execution Contextdist/index.js
MediumDynamic Requiredist/index.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEval
LowFilesystem
Affected versions and remediation
This report applies to autopilot-ai@1.2.1.
See all versions of autopilot-ai for other recorded verdicts.
- Review the evidence and your use of autopilot-ai@1.2.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.