registry / autopilot-ai / 1.20.0
autopilot-ai@1.20.0
autopilot (formerly kimiflare): a terminal coding agent that runs any OpenRouter model with your own key. Per-turn billed cost, web search, GitHub, headless browser, LSP, MCP, local memory.
AI Security Review
scanned 25d ago · by lpm-firewall-aiThe manifest has no install-time lifecycle hook, and inspected agent evaluation is isolated with tool access mediated by the executor. The scanner’s remote-execution and DNS hints are not supported as malicious behavior by the source reviewed.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
A user invokes the CLI or SDK coding-agent functionality.
Impact
No malicious impact was established from the inspected behavior.
Mechanism
The agent evaluates code in an isolated VM with a memory limit and routes tool calls through its executor and permission gate.
AI rationale
The manifest has no install-time lifecycle hook, and inspected agent evaluation is isolated with tool access mediated by the executor. The scanner’s remote-execution and DNS hints are not supported as malicious behavior by the source reviewed.
Evidence
package.jsondist/index.jsdist/sdk/index.jsdist/sdk/index.d.ts
Decision evidence
public snapshotAI called this Clean at 86.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json exposes the CLI and two JavaScript entrypoints; its only lifecycle script is prepublishOnly, which runs a build.
- The flagged agent code reads bounded workspace context files and creates a permission gate for tool requests.
- The flagged dynamic evaluation runs inside isolated-vm with a configurable memory limit; tool access is routed through the supplied executor.
- dist/sdk/index.d.ts contains public type declarations, including agent modes and tool-call shapes.
Evidence against
- Static hints report remote-response execution and DNS exfiltration, but inspected code shows isolated evaluation and no matching DNS lookup in dist/index.js.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
15 flaggeddist/index.jsView file
59function defaultLogDir() {
L60: const xdg = process.env.XDG_CONFIG_HOME || join(homedir(), ".config");
L61: return join(xdg, "kimiflare", "logs");
...
L76: if (currentStream) {
L77: currentStream.end();
L78: currentStream = null;
...
L195: function setFetchForTesting(f) {
L196: fetchImpl = f ?? ((url, init) => fetch(url, init));
L197: }
...
L651: const raw = await readFile(configPath(), "utf8");
L652: persisted = JSON.parse(raw);
L653: hasFile = true;
Critical
Dns Exfiltration
Source appears to send environment or credential material through DNS lookups.
dist/index.jsView on unpkg · L5959function defaultLogDir() {
L60: const xdg = process.env.XDG_CONFIG_HOME || join(homedir(), ".config");
L61: return join(xdg, "kimiflare", "logs");
...
L76: if (currentStream) {
L77: currentStream.end();
L78: currentStream = null;
...
L195: function setFetchForTesting(f) {
L196: fetchImpl = f ?? ((url, init) => fetch(url, init));
L197: }
...
L651: const raw = await readFile(configPath(), "utf8");
L652: persisted = JSON.parse(raw);
L653: hasFile = true;
Critical
Remote Response Code Execution
Source passes code obtained from a remote response into a dynamic execution sink.
dist/index.jsView on unpkg · L5959Trigger-reachable chain: manifest.exports -> dist/index.js
L59: function defaultLogDir() {
L60: const xdg = process.env.XDG_CONFIG_HOME || join(homedir(), ".config");
L61: return join(xdg, "kimiflare", "logs");
...
L76: if (currentStream) {
L77: currentStream.end();
L78: currentStream = null;
...
L195: function setFetchForTesting(f) {
L196: fetchImpl = f ?? ((url, init) => fetch(url, init));
L197: }
...
L651: const raw = await readFile(configPath(), "utf8");
L652: persisted = JSON.parse(raw);
L653: hasFile = true;
Findings
4 Critical11 High4 Medium5 Low
CriticalDns Exfiltrationdist/index.js
CriticalRemote Response Code Executiondist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
CriticalPrevious Version Dangerous Deltadist/sdk/index.js
HighChild Processdist/index.js
HighShelldist/index.js
HighEval
HighSame File Env Network Executiondist/sdk/index.js
HighCredential Redirect Persistencedist/index.js
HighCommand Output Exfiltrationdist/index.js
HighObfuscated Payload Loaderdist/index.js
HighRemote Agent Bridgedist/index.js
Affected versions and remediation
This report applies to autopilot-ai@1.20.0.
See all versions of autopilot-ai for other recorded verdicts.
- Review the evidence and your use of autopilot-ai@1.20.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.