registry / autopilot-ai / 1.23.0
autopilot-ai@1.23.0
autopilot (formerly kimiflare): a terminal coding agent that runs any OpenRouter model with your own key. Per-turn billed cost, web search, GitHub, headless browser, LSP, MCP, local memory.
AI Security Review
scanned 19d ago · by lpm-firewall-aiStatic hints point to network, evaluation, and dynamic-loading primitives, but inspected source ties them to provider use, a user-submitted inbox request, and isolated caller-supplied code. No concrete attack behavior was established.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
The CLI runs when invoked; inbox requests occur after the user submits the inbox form.
Impact
No confirmed unauthorized data transfer, remote code execution, or other attack effect was established.
Mechanism
Provider calls use configured service endpoints, inbox credentials are collected for the inbox feature, and tool calls from isolated code pass through a permission executor.
AI rationale
Static hints point to network, evaluation, and dynamic-loading primitives, but inspected source ties them to provider use, a user-submitted inbox request, and isolated caller-supplied code. No concrete attack behavior was established.
Evidence
package.jsonbin/autopilot.mjsdist/index.jsdist/index.d.tsdist/sdk/index.jsdist/sdk/index.d.ts
Network endpoints3
openrouter.airouter.requesty.aihello.kimiflare.com
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json exports the CLI and bundled runtime; its only publish lifecycle script runs a build.
- The CLI and SDK read bounded project context files and pass their contents into the agent context.
- The source configures OpenRouter and restricts Requesty endpoints to HTTPS hosts on its allowlist.
- The inbox asks the user for a handle and password-style secret, then sends them to the package's inbox service after submission.
- The code runner compiles caller-provided code in an isolated VM and routes tool calls through its permission executor.
- The root declaration exports no types; the SDK declaration contains API types rather than executable code.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShell
HighEntropyStrings
Source & flagged code
16 flaggeddist/index.jsView file
68Source sends the broad process environment to a literal external destination.
L68: function defaultLogDir() {
L69: const xdg = process.env.XDG_CONFIG_HOME || join(homedir(), ".config");
L70: return join(xdg, "kimiflare", "logs");
...
L85: if (currentStream) {
L86: currentStream.end();
L87: currentStream = null;
...
L204: function setFetchForTesting(f) {
L205: fetchImpl = f ?? ((url, init) => fetch(url, init));
L206: }
...
L660: const raw = await readFile(configPath(), "utf8");
L661: persisted = JSON.parse(raw);
L662: hasFile = true;
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
dist/index.jsView on unpkg · L6868function defaultLogDir() {
L69: const xdg = process.env.XDG_CONFIG_HOME || join(homedir(), ".config");
L70: return join(xdg, "kimiflare", "logs");
...
L85: if (currentStream) {
L86: currentStream.end();
L87: currentStream = null;
...
L204: function setFetchForTesting(f) {
L205: fetchImpl = f ?? ((url, init) => fetch(url, init));
L206: }
...
L660: const raw = await readFile(configPath(), "utf8");
L661: persisted = JSON.parse(raw);
L662: hasFile = true;
Critical
Dns Exfiltration
Source appears to send environment or credential material through DNS lookups.
dist/index.jsView on unpkg · L68Findings
4 Critical11 High4 Medium6 Low
CriticalHardcoded Runtime Data Exfiltrationdist/index.js
CriticalDns Exfiltrationdist/index.js
CriticalRemote Response Code Executiondist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
HighChild Processdist/index.js
HighShelldist/index.js
HighEval
HighSame File Env Network Executiondist/sdk/index.js
HighCredential Redirect Persistencedist/index.js
HighCommand Output Exfiltrationdist/sdk/index.js
HighObfuscated Payload Loaderdist/index.js
HighRemote Agent Bridgedist/index.js
Affected versions and remediation
This report applies to autopilot-ai@1.23.0.
See all versions of autopilot-ai for other recorded verdicts.
- Review the evidence and your use of autopilot-ai@1.23.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.