registry / autopilot-ai / 1.22.1
autopilot-ai@1.22.1
autopilot (formerly kimiflare): a terminal coding agent that runs any OpenRouter model with your own key. Per-turn billed cost, web search, GitHub, headless browser, LSP, MCP, local memory.
AI Security Review
scanned 19d ago · by lpm-firewall-aiSource inspection found no install hook or confirmed attack behavior. The scanner’s eval and agent-configuration indicators correspond to the package’s code tool and bounded project-context reads.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Normal CLI use, including an explicit /init command to generate project context.
Impact
No unauthorized credential transfer or install-time agent configuration change was identified.
Mechanism
The flagged context paths read bounded local project files, and the credential check uses the OpenRouter base URL.
AI rationale
Source inspection found no install hook or confirmed attack behavior. The scanner’s eval and agent-configuration indicators correspond to the package’s code tool and bounded project-context reads.
Evidence
package.jsondist/index.jsdist/sdk/index.jsdist/sdk/index.d.ts
Network endpoints1
openrouter.ai/api/v1
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json lists prepublishOnly as a build command; no install lifecycle hook is listed.
- The flagged bundles read bounded project context files such as AGENTS.md; this is not an agent settings mutation.
- The OpenRouter key check sends the key to a URL built from the OpenRouter base, which defaults to https://openrouter.ai/api/v1.
- The SDK describes custom endpoint credentials as caller-configured and sends them to the configured base URL.
- The eval matches run code supplied through the code-tool input; the tool API is built from configured tools.
- The /init path is an explicit user command that builds a project context prompt.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
15 flaggeddist/index.jsView file
59function defaultLogDir() {
L60: const xdg = process.env.XDG_CONFIG_HOME || join(homedir(), ".config");
L61: return join(xdg, "kimiflare", "logs");
...
L76: if (currentStream) {
L77: currentStream.end();
L78: currentStream = null;
...
L195: function setFetchForTesting(f) {
L196: fetchImpl = f ?? ((url, init) => fetch(url, init));
L197: }
...
L651: const raw = await readFile(configPath(), "utf8");
L652: persisted = JSON.parse(raw);
L653: hasFile = true;
Critical
Dns Exfiltration
Source appears to send environment or credential material through DNS lookups.
dist/index.jsView on unpkg · L5959function defaultLogDir() {
L60: const xdg = process.env.XDG_CONFIG_HOME || join(homedir(), ".config");
L61: return join(xdg, "kimiflare", "logs");
...
L76: if (currentStream) {
L77: currentStream.end();
L78: currentStream = null;
...
L195: function setFetchForTesting(f) {
L196: fetchImpl = f ?? ((url, init) => fetch(url, init));
L197: }
...
L651: const raw = await readFile(configPath(), "utf8");
L652: persisted = JSON.parse(raw);
L653: hasFile = true;
Critical
Remote Response Code Execution
Source passes code obtained from a remote response into a dynamic execution sink.
dist/index.jsView on unpkg · L59•Trigger-reachable chain: manifest.exports -> dist/index.js
Reachable file contains a blocking source-risk pattern.
Findings
3 Critical11 High4 Medium6 Low
CriticalDns Exfiltrationdist/index.js
CriticalRemote Response Code Executiondist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
HighChild Processdist/index.js
HighShelldist/index.js
HighEval
HighSame File Env Network Executiondist/sdk/index.js
HighCredential Redirect Persistencedist/index.js
HighCommand Output Exfiltrationdist/sdk/index.js
HighObfuscated Payload Loaderdist/index.js
HighRemote Agent Bridgedist/index.js
HighCross File Remote Execution Contextdist/index.js
Affected versions and remediation
This report applies to autopilot-ai@1.22.1.
See all versions of autopilot-ai for other recorded verdicts.
- Review the evidence and your use of autopilot-ai@1.22.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.