registry / autopilot-ai / 3.2.0
autopilot-ai@3.2.0
autopilot (formerly kimiflare): a terminal coding agent for any model with your own key: OpenRouter, Anthropic, OpenAI, Gemini, Bedrock, Vertex, Ollama and more. Per-turn cost, web search, GitHub, headless browser, LSP, MCP, local memory.
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe manifest has no install-time execution hook, and the flagged network and execution behaviors have package-related functions and user-directed triggers. The source reviewed did not show credentials being sent to an unrelated host or hidden execution.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
CLI use, explicit provider configuration, or an in-app user action.
Impact
No unsolicited credential collection, unrelated exfiltration, or concealed remote execution was identified.
Mechanism
Provider keys are associated with their configured services; the inbox requests its own handle and secret before use, and sandbox code receives an explicit tool bridge.
AI rationale
The manifest has no install-time execution hook, and the flagged network and execution behaviors have package-related functions and user-directed triggers. The source reviewed did not show credentials being sent to an unrelated host or hidden execution.
Network endpoints3
api.anthropic.comai-gateway.vercel.shhello.kimiflare.com
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The only lifecycle script is prepublishOnly, which runs the build; no install hook is declared.
- The CLI entry imports the package's main application entry point.
- The Anthropic provider pairs ANTHROPIC_API_KEY with api.anthropic.com; the Vercel gateway is a separately configured provider using its own key.
- The inbox flow prompts for a handle and secret before sending them to the inbox service.
- The flagged eval calls run model-written code in an isolated-vm sandbox and bridge only the tools supplied to that sandbox.
- An LSP install command is offered for the user to select before it runs.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
15 flaggeddist/index.jsView file
1369const iat = Math.floor(now2 / 1e3);
L1370: const payload = enc({ iss: sa.client_email, scope: SCOPE, aud: sa.token_uri ?? "https://oauth2.googleapis.com/token", iat, exp: iat + 3600 });
L1371: const signature = createSign("RSA-SHA256").update(`${header}.${payload}`).sign(sa.private_key).toString("base64url");
...
L1376: const tokenUrl = creds.type === "service_account" ? creds.token_uri ?? "https://oauth2.googleapis.com/token" : "https://oauth2.googleapis.com/token";
L1377: const body = creds.type === "service_account" ? new URLSearchParams({ grant_type: "urn:ietf:params:oauth:grant-type:jwt-bearer", assertion: signJwt(creds, now2) }) : new URLSearchP...
L1378: const res = await fetchImpl3(tokenUrl, { method: "POST", headers: { "Content-Type": "application/x-www-form-urlencoded" },
Critical
Command Output Exfiltration
Source executes local commands and sends command output to an external endpoint.
dist/index.jsView on unpkg · L136939function home(env) {
L40: return env.HOME || homedir();
L41: }
...
L50: }
L51: function configDir(env = process.env) {
L52: return join(configHome(env), APP_DIR_NAME);
...
L310: stream.once("error", () => resolve25());
L311: stream.end();
L312: });
...
L461: function setFetchForTesting(f) {
L462: fetchImpl = f ?? ((url, init) => fetch(url, init));
L463: }
Critical
Dns Exfiltration
Source appears to send environment or credential material through DNS lookups.
dist/index.jsView on unpkg · L39Findings
6 Critical8 High4 Medium6 Low
CriticalHardcoded Runtime Data Exfiltrationdist/sdk/index.js
CriticalCommand Output Exfiltrationdist/index.js
CriticalDns Exfiltrationdist/index.js
CriticalRemote Response Code Executiondist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
CriticalPrevious Version Dangerous Deltadist/sdk/index.js
HighChild Processdist/index.js
HighShelldist/index.js
HighEval
HighSame File Env Network Executiondist/index.js
HighCredential Redirect Persistencedist/index.js
HighRemote Agent Bridgedist/index.js
Affected versions and remediation
This report applies to autopilot-ai@3.2.0.
See all versions of autopilot-ai for other recorded verdicts.
- Review the evidence and your use of autopilot-ai@3.2.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.