registry / autopilot-ai / 3.0.4
autopilot-ai@3.0.4
autopilot (formerly kimiflare): a terminal coding agent for any model with your own key: OpenRouter, Anthropic, OpenAI, Gemini, Bedrock, Vertex, Ollama and more. Per-turn cost, web search, GitHub, headless browser, LSP, MCP, local memory.
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe manifest has no install-time hook, and the reviewed Hotcell path requires explicit permission plus user-supplied endpoint credentials. The flagged gateway is a named provider, and the reviewed source does not show an automatic credential redirect or exfiltration path.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
The CLI starts when invoked; subagent provisioning requires a permitted tool call and configured Hotcell credentials.
Impact
No unauthorized credential collection, data transfer, or persistence was identified in the reviewed paths.
Mechanism
The package supports named model-provider endpoints and can provision a Hotcell cell through an endpoint configured in the environment.
AI rationale
The manifest has no install-time hook, and the reviewed Hotcell path requires explicit permission plus user-supplied endpoint credentials. The flagged gateway is a named provider, and the reviewed source does not show an automatic credential redirect or exfiltration path.
Network endpoints2
ai-gateway.vercel.sh/v1AUTOPILOT_HOTCELL_ENDPOINT (configured by the user)
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The only lifecycle script is prepublishOnly, which runs the build; there is no install-time hook.
- The CLI imports dist/index.js, but the subagent capability is marked as requiring permission.
- Subagents require an active OpenRouter key and a provider configuration that supports the Hotcell gateway.
- Hotcell setup reads its endpoint and API key from explicit AUTOPILOT_HOTCELL_ENDPOINT and AUTOPILOT_HOTCELL_API_KEY environment variables.
- For other providers, the cell receives a per-cell egress token and configured gateway route.
Evidence against
- The scanner's command execution and dynamic evaluation indicators are consistent with a terminal coding agent and its sandboxed agent features.
- The flagged Vercel gateway URL is listed as a named provider endpoint, rather than an automatic credential redirect.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
Source & flagged code
15 flaggeddist/index.jsView file
1102const iat = Math.floor(now2 / 1e3);
L1103: const payload = enc({ iss: sa.client_email, scope: SCOPE, aud: sa.token_uri ?? "https://oauth2.googleapis.com/token", iat, exp: iat + 3600 });
L1104: const signature = createSign("RSA-SHA256").update(`${header}.${payload}`).sign(sa.private_key).toString("base64url");
...
L1109: const tokenUrl = creds.type === "service_account" ? creds.token_uri ?? "https://oauth2.googleapis.com/token" : "https://oauth2.googleapis.com/token";
L1110: const body = creds.type === "service_account" ? new URLSearchParams({ grant_type: "urn:ietf:params:oauth:grant-type:jwt-bearer", assertion: signJwt(creds, now2) }) : new URLSearchP...
L1111: const res = await fetchImpl2(tokenUrl, { method: "POST", headers: { "Content-Type": "application/x-www-form-urlencoded" },
Critical
Command Output Exfiltration
Source executes local commands and sends command output to an external endpoint.
dist/index.jsView on unpkg · L110225}
L26: function readEnv(suffix, env = process.env) {
L27: const [current, legacy] = envNames(suffix);
...
L82: function defaultLogDir() {
L83: const xdg = process.env.XDG_CONFIG_HOME || join(homedir(), ".config");
L84: return join(xdg, "kimiflare", "logs");
...
L99: if (currentStream) {
L100: currentStream.end();
L101: currentStream = null;
...
L230: function setFetchForTesting(f) {
L231: fetchImpl = f ?? ((url, init) => fetch(url, init));
L232: }
Critical
Dns Exfiltration
Source appears to send environment or credential material through DNS lookups.
dist/index.jsView on unpkg · L25Findings
6 Critical8 High4 Medium6 Low
CriticalHardcoded Runtime Data Exfiltrationdist/sdk/index.js
CriticalCommand Output Exfiltrationdist/index.js
CriticalDns Exfiltrationdist/index.js
CriticalRemote Response Code Executiondist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
CriticalPrevious Version Dangerous Deltadist/sdk/index.d.ts
HighChild Processdist/index.js
HighShelldist/index.js
HighEval
HighSame File Env Network Executiondist/index.js
HighCredential Redirect Persistencedist/index.js
HighRemote Agent Bridgedist/index.js
Affected versions and remediation
This report applies to autopilot-ai@3.0.4.
See all versions of autopilot-ai for other recorded verdicts.
- Review the evidence and your use of autopilot-ai@3.0.4 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.