registry / autopilot-ai / 1.4.0
autopilot-ai@1.4.0
autopilot (formerly kimiflare): a terminal coding agent that runs any OpenRouter model with your own key. Per-turn billed cost, web search, GitHub, headless browser, LSP, MCP, local memory.
AI Security Review
scanned 1mo ago · by lpm-firewall-aiStatic inspection found no malicious install hook or concrete attack behavior. The identified agent integration reads project-local instructions for the package's skill index and uses the configured model endpoint, which is package-aligned behavior.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A user runs the CLI or creates an SDK session.
Impact
No unconsented install-time modification, foreign agent-control-surface write, or credential export to an unrelated recipient was established.
Mechanism
The CLI discovers local skill files and submits their embedding input to its configured model endpoint; no install-time agent configuration mutation was found.
AI rationale
Static inspection found no malicious install hook or concrete attack behavior. The identified agent integration reads project-local instructions for the package's skill index and uses the configured model endpoint, which is package-aligned behavior.
Decision evidence
public snapshotAI called this Clean at 90.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package scripts contain only a publish-time build hook and no install lifecycle hook.
- The CLI indexes project-local agent instruction and skill files as part of its skill discovery.
- Skill text is embedded through the configured model endpoint using the endpoint's configured credential.
- The SDK permission handler applies explicit mode-dependent decisions.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
12 flaggeddist/index.jsView file
185function configPath() {
L186: const xdg = process.env.XDG_CONFIG_HOME || join(homedir(), ".config");
L187: return join(xdg, "kimiflare", "config.json");
...
L222: const raw = await readFile(configPath(), "utf8");
L223: persisted = JSON.parse(raw);
L224: hasFile = true;
...
L517: const here = dirname2(fileURLToPath(import.meta.url));
L518: const candidates = [join3(here, "..", "..", "package.json"), join3(here, "..", "package.json")];
L519: for (const path of candidates) {
...
L530: function getUserAgent() {
L531: return `${CLI_NAME}/${getAppVersion()} (+https://github.com/sinameraji/autopilot)`;
L532: }
Critical
Remote Response Code Execution
Source passes code obtained from a remote response into a dynamic execution sink.
dist/index.jsView on unpkg · L185•matchType = previous_version_dangerous_delta
matchedPackage = autopilot-ai@1.2.1
matchedIdentity = npm:YXV0b3BpbG90LWFp:1.2.1
similarity = 0.600
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/index.jsView on unpkg696// src/remote/deploy.ts
L697: import { execSync } from "child_process";
L698: import { join as join6, dirname as dirname4 } from "path";
Findings
2 Critical10 High4 Medium5 Low
CriticalRemote Response Code Executiondist/index.js
CriticalPrevious Version Dangerous Deltadist/index.js
HighChild Processdist/index.js
HighShelldist/index.js
HighEval
HighSame File Env Network Executiondist/sdk/index.js
HighCredential Redirect Persistencedist/index.js
HighCommand Output Exfiltrationdist/sdk/index.js
HighObfuscated Payload Loaderdist/index.js
HighRemote Agent Bridgedist/index.js
HighCross File Remote Execution Contextdist/index.js
HighTrigger Reachable Command Output Exfiltrationdist/sdk/index.js
Affected versions and remediation
This report applies to autopilot-ai@1.4.0.
See all versions of autopilot-ai for other recorded verdicts.
- Review the evidence and your use of autopilot-ai@1.4.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.