registry / autopilot-ai / 1.20.1
autopilot-ai@1.20.1
autopilot (formerly kimiflare): a terminal coding agent that runs any OpenRouter model with your own key. Per-turn billed cost, web search, GitHub, headless browser, LSP, MCP, local memory.
AI Security Review
scanned 24d ago · by lpm-firewall-aiThe manifest has no install-time mutation hook, and the flagged agent-context locations read bounded project files rather than altering agent configuration. The inspected credential routing and network behavior are package-aligned; scanner hints alone do not establish a concrete attack.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Using the CLI or SDK features that make provider requests or load project context.
Impact
No concrete malicious effect was established from the inspected source.
Mechanism
Provider keys go to their selected provider, Requesty endpoints are restricted to Requesty hosts, and context files are read with a size limit.
AI rationale
The manifest has no install-time mutation hook, and the flagged agent-context locations read bounded project files rather than altering agent configuration. The inspected credential routing and network behavior are package-aligned; scanner hints alone do not establish a concrete attack.
Evidence
package.jsondist/index.jsdist/sdk/index.jsdist/sdk/index.d.ts
Network endpoints4
kimiflare.comhello.kimiflare.comrouter.requesty.ai/v1openrouter.ai/api/v1
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json exposes a CLI and two library entrypoints; its only lifecycle hook is prepublishOnly building the package.
- The flagged agent-context code reads a bounded set of project context files; it does not show a write to agent configuration or a plugin install.
- The SDK bundle uses the same bounded context-file reader.
- The declaration file contains type declarations rather than executable behavior.
- Requesty endpoint selection requires HTTPS and restricts hostnames to Requesty domains.
- OpenRouter API keys are sent in the Authorization header to the OpenRouter service; Requesty keys are used only when no custom endpoint or OpenRouter key is selected.
- A feedback-worker URL uses the package's kimiflare.com domain.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShell
Source & flagged code
14 flaggeddist/index.jsView file
59function defaultLogDir() {
L60: const xdg = process.env.XDG_CONFIG_HOME || join(homedir(), ".config");
L61: return join(xdg, "kimiflare", "logs");
...
L76: if (currentStream) {
L77: currentStream.end();
L78: currentStream = null;
...
L195: function setFetchForTesting(f) {
L196: fetchImpl = f ?? ((url, init) => fetch(url, init));
L197: }
...
L651: const raw = await readFile(configPath(), "utf8");
L652: persisted = JSON.parse(raw);
L653: hasFile = true;
Critical
Dns Exfiltration
Source appears to send environment or credential material through DNS lookups.
dist/index.jsView on unpkg · L5959function defaultLogDir() {
L60: const xdg = process.env.XDG_CONFIG_HOME || join(homedir(), ".config");
L61: return join(xdg, "kimiflare", "logs");
...
L76: if (currentStream) {
L77: currentStream.end();
L78: currentStream = null;
...
L195: function setFetchForTesting(f) {
L196: fetchImpl = f ?? ((url, init) => fetch(url, init));
L197: }
...
L651: const raw = await readFile(configPath(), "utf8");
L652: persisted = JSON.parse(raw);
L653: hasFile = true;
Critical
Remote Response Code Execution
Source passes code obtained from a remote response into a dynamic execution sink.
dist/index.jsView on unpkg · L5959Trigger-reachable chain: manifest.exports -> dist/index.js
L59: function defaultLogDir() {
L60: const xdg = process.env.XDG_CONFIG_HOME || join(homedir(), ".config");
L61: return join(xdg, "kimiflare", "logs");
...
L76: if (currentStream) {
L77: currentStream.end();
L78: currentStream = null;
...
L195: function setFetchForTesting(f) {
L196: fetchImpl = f ?? ((url, init) => fetch(url, init));
L197: }
...
L651: const raw = await readFile(configPath(), "utf8");
L652: persisted = JSON.parse(raw);
L653: hasFile = true;
Findings
3 Critical11 High4 Medium5 Low
CriticalDns Exfiltrationdist/index.js
CriticalRemote Response Code Executiondist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
HighChild Processdist/index.js
HighShelldist/index.js
HighEval
HighSame File Env Network Executiondist/sdk/index.js
HighCredential Redirect Persistencedist/index.js
HighCommand Output Exfiltrationdist/index.js
HighObfuscated Payload Loaderdist/index.js
HighRemote Agent Bridgedist/index.js
HighCross File Remote Execution Contextdist/index.js
Affected versions and remediation
This report applies to autopilot-ai@1.20.1.
See all versions of autopilot-ai for other recorded verdicts.
- Review the evidence and your use of autopilot-ai@1.20.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.