registry / autopilot-ai / 2.7.1
autopilot-ai@2.7.1
autopilot (formerly kimiflare): a terminal coding agent for any model with your own key: OpenRouter, Anthropic, OpenAI, Gemini, Bedrock, Vertex, Ollama and more. Per-turn cost, web search, GitHub, headless browser, LSP, MCP, local memory.
AI Security Review
scanned 7d ago · by lpm-firewall-aiInspected source shows no malicious behavior or npm install lifecycle; the inbox transfer follows form submission and uses values entered for that inbox. The flagged evaluation, network, and subprocess primitives correspond to sandbox, provider, and user-invoked features, while telemetry has no default configuration.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Running the CLI or invoking a product feature; the inbox request requires submitting its form.
Impact
No confirmed attack impact.
Mechanism
The inbox sends caller-entered values to the product inbox service; isolated execution compiles code supplied to the sandbox call. No malicious collection or hidden install-time behavior was established.
AI rationale
Inspected source shows no malicious behavior or npm install lifecycle; the inbox transfer follows form submission and uses values entered for that inbox. The flagged evaluation, network, and subprocess primitives correspond to sandbox, provider, and user-invoked features, while telemetry has no default configuration.
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json exposes the CLI and two bundles; its publish hook only runs a build, and the CLI imports the main bundle.
- The inbox form asks for a handle and password secret; cancellation or missing values stop the request, which checks the inbox at the product host.
- The dynamic evaluation runs code supplied through the sandbox call and applies a timeout.
- The SDK telemetry sink starts with no configuration and drops queued events when no configuration exists.
- Inspected dependency manifests show a build-only script for @hotcell/sdk, no scripts in @modelcontextprotocol/sdk, and a conventional native build install hook for better-sqlite3; its entrypoint re-exports the database module.
Evidence against
- The bundle contains network, subprocess, and isolated execution capabilities, but inspected paths tie them to product features and user-provided actions.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystem
Source & flagged code
14 flaggeddist/index.jsView file
41Source sends the broad process environment to a literal external destination.
L41: function defaultLogDir() {
L42: const xdg = process.env.XDG_CONFIG_HOME || join(homedir(), ".config");
L43: return join(xdg, "kimiflare", "logs");
...
L58: if (currentStream) {
L59: currentStream.end();
L60: currentStream = null;
...
L188: function setFetchForTesting(f) {
L189: fetchImpl = f ?? ((url, init) => fetch(url, init));
L190: }
...
L989: import { createSign } from "crypto";
L990: import { execFile } from "child_process";
L991: import { readFile } from "fs/promises";
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
dist/index.jsView on unpkg · L411055const iat = Math.floor(now2 / 1e3);
L1056: const payload = enc({ iss: sa.client_email, scope: SCOPE, aud: sa.token_uri ?? "https://oauth2.googleapis.com/token", iat, exp: iat + 3600 });
L1057: const signature = createSign("RSA-SHA256").update(`${header}.${payload}`).sign(sa.private_key).toString("base64url");
...
L1062: const tokenUrl = creds.type === "service_account" ? creds.token_uri ?? "https://oauth2.googleapis.com/token" : "https://oauth2.googleapis.com/token";
L1063: const body = creds.type === "service_account" ? new URLSearchParams({ grant_type: "urn:ietf:params:oauth:grant-type:jwt-bearer", assertion: signJwt(creds, now2) }) : new URLSearchP...
L1064: const res = await fetchImpl2(tokenUrl, { method: "POST", headers: { "Content-Type": "application/x-www-form-urlencoded" },
Critical
Command Output Exfiltration
Findings
5 Critical8 High4 Medium6 Low
CriticalHardcoded Runtime Data Exfiltrationdist/index.js
CriticalCommand Output Exfiltrationdist/index.js
CriticalDns Exfiltrationdist/index.js
CriticalRemote Response Code Executiondist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
HighChild Processdist/index.js
HighShelldist/index.js
HighEval
HighSame File Env Network Executiondist/index.js
HighCredential Redirect Persistencedist/index.js
HighRemote Agent Bridgedist/index.js
HighCross File Remote Execution Contextdist/index.js
Affected versions and remediation
This report applies to autopilot-ai@2.7.1.
See all versions of autopilot-ai for other recorded verdicts.
- Review the evidence and your use of autopilot-ai@2.7.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.