registry / autopilot-ai / 1.22.2
autopilot-ai@1.22.2
autopilot (formerly kimiflare): a terminal coding agent that runs any OpenRouter model with your own key. Per-turn billed cost, web search, GitHub, headless browser, LSP, MCP, local memory.
AI Security Review
scanned 19d ago · by lpm-firewall-aiThe source does not support the scanner’s malicious verdict: the manifest has no install hook, and inspected runtime behavior matches the package’s coding-agent functionality. The dynamic evaluation is sandboxed, and no malicious behavior was identified.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
The CLI or SDK is used for coding-agent tasks.
Impact
No malicious impact was established.
Mechanism
The application reads project context for its prompt and evaluates generated code in a sandbox; exposed tool calls use a permission handler.
AI rationale
The source does not support the scanner’s malicious verdict: the manifest has no install hook, and inspected runtime behavior matches the package’s coding-agent functionality. The dynamic evaluation is sandboxed, and no malicious behavior was identified.
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest defines `prepublishOnly` as a build command and contains no npm install lifecycle hook.
- The CLI loads bounded project context files such as `AGENTS.md` for its agent prompt; the SDK has the same behavior.
- Generated code runs in a sandbox, and exposed tool calls are passed through a permission handler.
- The SDK declarations expose permission-related types as part of its public API.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
16 flaggeddist/index.jsView file
68function defaultLogDir() {
L69: const xdg = process.env.XDG_CONFIG_HOME || join(homedir(), ".config");
L70: return join(xdg, "kimiflare", "logs");
...
L85: if (currentStream) {
L86: currentStream.end();
L87: currentStream = null;
...
L204: function setFetchForTesting(f) {
L205: fetchImpl = f ?? ((url, init) => fetch(url, init));
L206: }
...
L660: const raw = await readFile(configPath(), "utf8");
L661: persisted = JSON.parse(raw);
L662: hasFile = true;
Critical
Dns Exfiltration
Source appears to send environment or credential material through DNS lookups.
dist/index.jsView on unpkg · L6868function defaultLogDir() {
L69: const xdg = process.env.XDG_CONFIG_HOME || join(homedir(), ".config");
L70: return join(xdg, "kimiflare", "logs");
...
L85: if (currentStream) {
L86: currentStream.end();
L87: currentStream = null;
...
L204: function setFetchForTesting(f) {
L205: fetchImpl = f ?? ((url, init) => fetch(url, init));
L206: }
...
L660: const raw = await readFile(configPath(), "utf8");
L661: persisted = JSON.parse(raw);
L662: hasFile = true;
Critical
Remote Response Code Execution
Source passes code obtained from a remote response into a dynamic execution sink.
dist/index.jsView on unpkg · L68•Trigger-reachable chain: manifest.exports -> dist/index.js
Reachable file contains a blocking source-risk pattern.
Findings
4 Critical11 High4 Medium6 Low
CriticalDns Exfiltrationdist/index.js
CriticalRemote Response Code Executiondist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
CriticalPrevious Version Dangerous Deltadist/index.js
HighChild Processdist/index.js
HighShelldist/index.js
HighEval
HighSame File Env Network Executiondist/sdk/index.js
HighCredential Redirect Persistencedist/index.js
HighCommand Output Exfiltrationdist/sdk/index.js
HighObfuscated Payload Loaderdist/index.js
HighRemote Agent Bridgedist/index.js
Affected versions and remediation
This report applies to autopilot-ai@1.22.2.
See all versions of autopilot-ai for other recorded verdicts.
- Review the evidence and your use of autopilot-ai@1.22.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.