registry / autopilot-ai / 3.1.2
autopilot-ai@3.1.2
autopilot (formerly kimiflare): a terminal coding agent for any model with your own key: OpenRouter, Anthropic, OpenAI, Gemini, Bedrock, Vertex, Ollama and more. Per-turn cost, web search, GitHub, headless browser, LSP, MCP, local memory.
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe manifest has no install hook, and the inspected provider credential flow is tied to provider setup and named provider endpoints. The scanner's exfiltration and execution leads were not substantiated as automatic or concealed behavior in the reviewed excerpts.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
The CLI runs when invoked; provider authentication and model requests require user setup or use.
Impact
No automatic credential theft, install-time data collection, or concealed remote execution was established.
Mechanism
The package provides provider-specific endpoints and key configuration alongside coding-agent command tools.
AI rationale
The manifest has no install hook, and the inspected provider credential flow is tied to provider setup and named provider endpoints. The scanner's exfiltration and execution leads were not substantiated as automatic or concealed behavior in the reviewed excerpts.
Network endpoints2
ai-gateway.vercel.shapi.kimi.ai
Decision evidence
public snapshotAI called this Clean at 82.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package exposes a CLI and JavaScript entry points, with no install, preinstall, or postinstall script; prepublishOnly only builds the package.
- The CLI entry file imports the main bundle, consistent with a command-line application.
- The Vercel provider uses an AI Gateway endpoint and an AI_GATEWAY_API_KEY, matching the package's advertised multi-provider AI client purpose.
- Provider authentication prompts for a key and checks it before saving and switching providers.
Evidence against
- The CLI includes command execution and network capabilities, which fit its stated role as a terminal coding agent.
- The flagged credential and remote execution patterns were not confirmed as automatic exfiltration or concealed execution in the inspected paths.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
Source & flagged code
14 flaggeddist/index.jsView file
1333const iat = Math.floor(now2 / 1e3);
L1334: const payload = enc({ iss: sa.client_email, scope: SCOPE, aud: sa.token_uri ?? "https://oauth2.googleapis.com/token", iat, exp: iat + 3600 });
L1335: const signature = createSign("RSA-SHA256").update(`${header}.${payload}`).sign(sa.private_key).toString("base64url");
...
L1340: const tokenUrl = creds.type === "service_account" ? creds.token_uri ?? "https://oauth2.googleapis.com/token" : "https://oauth2.googleapis.com/token";
L1341: const body = creds.type === "service_account" ? new URLSearchParams({ grant_type: "urn:ietf:params:oauth:grant-type:jwt-bearer", assertion: signJwt(creds, now2) }) : new URLSearchP...
L1342: const res = await fetchImpl2(tokenUrl, { method: "POST", headers: { "Content-Type": "application/x-www-form-urlencoded" },
Critical
Command Output Exfiltration
Source executes local commands and sends command output to an external endpoint.
dist/index.jsView on unpkg · L133339function home(env) {
L40: return env.HOME || homedir();
L41: }
...
L50: }
L51: function configDir(env = process.env) {
L52: return join(configHome(env), APP_DIR_NAME);
...
L310: stream.once("error", () => resolve25());
L311: stream.end();
L312: });
...
L461: function setFetchForTesting(f) {
L462: fetchImpl = f ?? ((url, init) => fetch(url, init));
L463: }
Critical
Dns Exfiltration
Source appears to send environment or credential material through DNS lookups.
dist/index.jsView on unpkg · L39Findings
5 Critical8 High4 Medium6 Low
CriticalHardcoded Runtime Data Exfiltrationdist/sdk/index.js
CriticalCommand Output Exfiltrationdist/index.js
CriticalDns Exfiltrationdist/index.js
CriticalRemote Response Code Executiondist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
HighChild Processdist/index.js
HighShelldist/index.js
HighEval
HighSame File Env Network Executiondist/index.js
HighCredential Redirect Persistencedist/index.js
HighRemote Agent Bridgedist/index.js
HighCross File Remote Execution Contextdist/index.js
Affected versions and remediation
This report applies to autopilot-ai@3.1.2.
See all versions of autopilot-ai for other recorded verdicts.
- Review the evidence and your use of autopilot-ai@3.1.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.