registry / autopilot-ai / 2.4.2
autopilot-ai@2.4.2
autopilot (formerly kimiflare): a terminal coding agent for any model with your own key: OpenRouter, Anthropic, OpenAI, Gemini, Bedrock, Vertex, Ollama and more. Per-turn cost, web search, GitHub, headless browser, LSP, MCP, local memory.
AI Security Review
scanned 13d ago · by lpm-firewall-aiThe scanner's dynamic execution and network matches resolve to sandboxed agent code execution and explicit feedback commands. The package's install-related lifecycle script only builds the package, and inspected dependency hooks are ordinary native setup.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
The inspected feedback flows require the user to invoke /inbox or /hello.
Impact
No unauthorized credential transfer, install-time mutation, or confirmed host-level remote code execution was established.
Mechanism
The inbox sends values entered in its form to the package's feedback service; Code Mode executes supplied code in an isolated VM.
AI rationale
The scanner's dynamic execution and network matches resolve to sandboxed agent code execution and explicit feedback commands. The package's install-related lifecycle script only builds the package, and inspected dependency hooks are ordinary native setup.
Network endpoints1
hello.kimiflare.com
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json exposes the CLI and library entrypoints; its install-related lifecycle script is prepublishOnly, which runs a build.
- Code Mode runs supplied code through isolated-vm with a default memory limit; this is agent functionality, not evidence of remote code execution against the host.
- The inbox sends handle and secret values entered in its form to the feedback service only after the form is submitted; /hello is an explicit command.
- Inspected dependency sources show an endpoint-configurable SDK, ordinary MCP package scripts, and better-sqlite3's native installer.
- The SDK merges saved configuration with caller-supplied opts.config and checks credentials for the selected provider.
Evidence against
- Scanner flags for eval, networking, and command execution are consistent with the inspected sandboxed code mode and agent functionality.
- No concrete unauthorized credential transfer, install-time mutation, or other attack behavior was identified in the inspected source.
Behavioral surface
ChildProcessCrypto
Source & flagged code
14 flaggeddist/index.jsView file
41Source sends the broad process environment to a literal external destination.
L41: function defaultLogDir() {
L42: const xdg = process.env.XDG_CONFIG_HOME || join(homedir(), ".config");
L43: return join(xdg, "kimiflare", "logs");
...
L58: if (currentStream) {
L59: currentStream.end();
L60: currentStream = null;
...
L188: function setFetchForTesting(f) {
L189: fetchImpl = f ?? ((url, init) => fetch(url, init));
L190: }
...
L989: import { createSign } from "crypto";
L990: import { execFile } from "child_process";
L991: import { readFile } from "fs/promises";
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
dist/index.jsView on unpkg · L411055const iat = Math.floor(now2 / 1e3);
L1056: const payload = enc({ iss: sa.client_email, scope: SCOPE, aud: sa.token_uri ?? "https://oauth2.googleapis.com/token", iat, exp: iat + 3600 });
L1057: const signature = createSign("RSA-SHA256").update(`${header}.${payload}`).sign(sa.private_key).toString("base64url");
...
L1062: const tokenUrl = creds.type === "service_account" ? creds.token_uri ?? "https://oauth2.googleapis.com/token" : "https://oauth2.googleapis.com/token";
L1063: const body = creds.type === "service_account" ? new URLSearchParams({ grant_type: "urn:ietf:params:oauth:grant-type:jwt-bearer", assertion: signJwt(creds, now2) }) : new URLSearchP...
L1064: const res = await fetchImpl2(tokenUrl, { method: "POST", headers: { "Content-Type": "application/x-www-form-urlencoded" },
Critical
Command Output Exfiltration
Findings
5 Critical8 High4 Medium6 Low
CriticalHardcoded Runtime Data Exfiltrationdist/index.js
CriticalCommand Output Exfiltrationdist/index.js
CriticalDns Exfiltrationdist/index.js
CriticalRemote Response Code Executiondist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
HighChild Processdist/index.js
HighShelldist/index.js
HighEval
HighSame File Env Network Executiondist/index.js
HighCredential Redirect Persistencedist/index.js
HighRemote Agent Bridgedist/index.js
HighCross File Remote Execution Contextdist/index.js
Affected versions and remediation
This report applies to autopilot-ai@2.4.2.
See all versions of autopilot-ai for other recorded verdicts.
- Review the evidence and your use of autopilot-ai@2.4.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.