registry / autopilot-ai / 3.3.0
autopilot-ai@3.3.0
autopilot (formerly kimiflare): a terminal coding agent for any model with your own key: OpenRouter, Anthropic, OpenAI, Gemini, Bedrock, Vertex, Ollama and more. Per-turn cost, web search, GitHub, headless browser, LSP, MCP, local memory.
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe routing hints resolve to ordinary provider configuration, credential redaction, and isolated execution for the coding-agent feature. The manifest has no install, preinstall, or postinstall hook, and the reviewed sources show no unrelated credential transfer or hidden execution chain.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
The CLI runs when invoked; exported modules are available to importing applications.
Impact
No evidence found of automatic credential theft, unrelated data collection, install-time abuse, or concealed remote code execution.
Mechanism
The reviewed provider endpoint is explicitly named as Vercel AI Gateway and uses its corresponding API key setting. Dynamic code execution is isolated in Code Mode.
AI rationale
The routing hints resolve to ordinary provider configuration, credential redaction, and isolated execution for the coding-agent feature. The manifest has no install, preinstall, or postinstall hook, and the reviewed sources show no unrelated credential transfer or hidden execution chain.
Network endpoints1
ai-gateway.vercel.sh
Decision evidence
public snapshotAI called this Clean at 88.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes a terminal CLI and JavaScript entrypoints; its only lifecycle script is prepublishOnly, which runs the build.
- The CLI launcher imports dist/index.js.
- The Vercel gateway is one named provider with its own base URL and AI_GATEWAY_API_KEY setting.
- Code Mode runs supplied code in an isolated VM with a memory limit.
- The secrets helper detects and redacts likely provider and GitHub tokens.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
16 flaggeddist/index.jsView file
1408const iat = Math.floor(now2 / 1e3);
L1409: const payload = enc({ iss: sa.client_email, scope: SCOPE, aud: sa.token_uri ?? "https://oauth2.googleapis.com/token", iat, exp: iat + 3600 });
L1410: const signature = createSign("RSA-SHA256").update(`${header}.${payload}`).sign(sa.private_key).toString("base64url");
...
L1415: const tokenUrl = creds.type === "service_account" ? creds.token_uri ?? "https://oauth2.googleapis.com/token" : "https://oauth2.googleapis.com/token";
L1416: const body = creds.type === "service_account" ? new URLSearchParams({ grant_type: "urn:ietf:params:oauth:grant-type:jwt-bearer", assertion: signJwt(creds, now2) }) : new URLSearchP...
L1417: const res = await fetchImpl3(tokenUrl, { method: "POST", headers: { "Content-Type": "application/x-www-form-urlencoded" },
Critical
Command Output Exfiltration
Source executes local commands and sends command output to an external endpoint.
dist/index.jsView on unpkg · L140836} from "fs";
L37: import { execFileSync } from "child_process";
L38: import { homedir } from "os";
...
L40: function home(env) {
L41: return env.HOME || homedir();
L42: }
...
L51: }
L52: function configDir(env = process.env) {
L53: return join(configHome(env), APP_DIR_NAME);
...
L349: stream.once("error", () => resolve25());
L350: stream.end();
L351: });
Critical
Dns Exfiltration
Source appears to send environment or credential material through DNS lookups.
dist/index.jsView on unpkg · L36Findings
6 Critical9 High4 Medium6 Low
CriticalHardcoded Runtime Data Exfiltrationdist/sdk/index.js
CriticalCommand Output Exfiltrationdist/index.js
CriticalDns Exfiltrationdist/index.js
CriticalRemote Response Code Executiondist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
CriticalPrevious Version Dangerous Deltadist/index.js
HighChild Processdist/index.js
HighShelldist/index.js
HighEval
HighSame File Env Network Executiondist/index.js
HighCredential Redirect Persistencedist/index.js
HighRemote Agent Bridgedist/index.js
Affected versions and remediation
This report applies to autopilot-ai@3.3.0.
See all versions of autopilot-ai for other recorded verdicts.
- Review the evidence and your use of autopilot-ai@3.3.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.