registry / autopilot-ai / 1.22.0
autopilot-ai@1.22.0
autopilot (formerly kimiflare): a terminal coding agent that runs any OpenRouter model with your own key. Per-turn billed cost, web search, GitHub, headless browser, LSP, MCP, local memory.
AI Security Review
scanned 24d ago · by lpm-firewall-aiThe inspected execution path is an optional sandboxed agent feature, while package.json contains no install-time execution hook. The indicated agent-context locations identify bounded reads of project instruction files, not configuration writes.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Code Mode is enabled and generated code is run during an agent session.
Impact
No malicious or unconsented attack effect was established from the inspected source.
Mechanism
The package evaluates supplied code in an isolated VM and exposes tool calls through its executor.
AI rationale
The inspected execution path is an optional sandboxed agent feature, while package.json contains no install-time execution hook. The indicated agent-context locations identify bounded reads of project instruction files, not configuration writes.
Evidence
package.jsondist/index.jsdist/sdk/index.jsdist/sdk/index.d.ts
Decision evidence
public snapshotAI called this Clean at 86.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json has no automatic install hook; its prepublishOnly script only builds.
- dist/index.js runs supplied code in isolated-vm with a memory limit; the SDK documents this as optional sandboxed Code Mode.
- The indicated context-file code reads bounded project agent instruction files; it does not modify agent configuration.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
16 flaggeddist/index.jsView file
59function defaultLogDir() {
L60: const xdg = process.env.XDG_CONFIG_HOME || join(homedir(), ".config");
L61: return join(xdg, "kimiflare", "logs");
...
L76: if (currentStream) {
L77: currentStream.end();
L78: currentStream = null;
...
L195: function setFetchForTesting(f) {
L196: fetchImpl = f ?? ((url, init) => fetch(url, init));
L197: }
...
L651: const raw = await readFile(configPath(), "utf8");
L652: persisted = JSON.parse(raw);
L653: hasFile = true;
Critical
Dns Exfiltration
Source appears to send environment or credential material through DNS lookups.
dist/index.jsView on unpkg · L5959function defaultLogDir() {
L60: const xdg = process.env.XDG_CONFIG_HOME || join(homedir(), ".config");
L61: return join(xdg, "kimiflare", "logs");
...
L76: if (currentStream) {
L77: currentStream.end();
L78: currentStream = null;
...
L195: function setFetchForTesting(f) {
L196: fetchImpl = f ?? ((url, init) => fetch(url, init));
L197: }
...
L651: const raw = await readFile(configPath(), "utf8");
L652: persisted = JSON.parse(raw);
L653: hasFile = true;
Critical
Remote Response Code Execution
Source passes code obtained from a remote response into a dynamic execution sink.
dist/index.jsView on unpkg · L59•Trigger-reachable chain: manifest.exports -> dist/index.js
Reachable file contains a blocking source-risk pattern.
Findings
4 Critical11 High4 Medium6 Low
CriticalDns Exfiltrationdist/index.js
CriticalRemote Response Code Executiondist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
CriticalPrevious Version Dangerous Deltadist/sdk/index.d.ts
HighChild Processdist/index.js
HighShelldist/index.js
HighEval
HighSame File Env Network Executiondist/sdk/index.js
HighCredential Redirect Persistencedist/index.js
HighCommand Output Exfiltrationdist/sdk/index.js
HighObfuscated Payload Loaderdist/index.js
HighRemote Agent Bridgedist/index.js
Affected versions and remediation
This report applies to autopilot-ai@1.22.0.
See all versions of autopilot-ai for other recorded verdicts.
- Review the evidence and your use of autopilot-ai@1.22.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.