registry / AI-agent capability abuse / beast-agent / 0.24.3

beast-agent@0.24.3

Ultra-fast local agent shell for Windows.

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

This is a high-risk autonomous-agent package with default-unapproved shell execution and unsigned remote code delivery paths. The source does not show concrete malicious install-time behavior, so warning is warranted rather than a publication block.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

A user or connected agent message causes the runtime to select a command, file-write, Python, or skill-install action.

Impact

A prompt-influenced or compromised model/provider could run commands, alter accessible files, or introduce unverified code into the user's Beast data directory.

Mechanism

LLM-directed shell execution, remote skill deployment, and unsigned runtime bootstrap.

AI rationale

Evidence

src/agent/tools.jssrc/agent/store.jssrc/main.js%APPDATA%\beast\skills\<id>\<remote file>%APPDATA%\beast\py\python.exe

Network endpoints2

raw.githubusercontent.com/algokodcom/beast-agent/main/store/skills.jsonwww.python.org/ftp/python/3.12.8/python-3.12.8-embed-amd64.zip

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

The agent can run a supplied command through PowerShell with execution-policy bypass.
Risky command, file-write, and Python tools have an approval gate, but the gate is disabled by default.
The skill store fetches a remote index and writes its supplied files into the local skills directory without content integrity verification.
On first Python use, it downloads and expands a Python archive without a checksum or signature check.

Evidence against

package.json has no preinstall, install, or postinstall lifecycle hook.
The package contains an interactive desktop-agent implementation; the observed execution features are product capabilities, not an install-time payload.
No concrete credential theft, covert exfiltration, self-dependency chain, or foreign AI-agent configuration mutation was found.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNativeBindingsNetworkShellWebSocket

Source & flagged code

9 flagged

bin/beast-agent.jsView file

7L8: const { spawn, spawnSync } = require('child_process'); L9: const path = require('path');

High

Child Process

Package source references child process execution.

bin/beast-agent.jsView on unpkg · L7

src/agent/engine.jsView file

1245'- Kodu ve dosyaları DOĞRUDAN write_file ile yaz/güncelle. Basit dosya oluşturma/düzenleme için asla Python scripti yazma; python_run yalnız gerçek hesap/veri işleme gerekiyorsa.\n... L1246: '- Kurulum, test, build, git gibi işler için run_command kullan (Windows PowerShell ortamı).\n' + L1247: '- Bağımsız araç çağrılarını AYNI TURDA paralel ver.\n' +

High

Shell

Package source references shell execution.

src/agent/engine.jsView on unpkg · L1245

src/agent/store.jsView file

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. src/agent/store.js: const COMMUNITY_URL = 'https://raw.githubusercontent.com/algokodcom/beast-agent/main/store/skills.json'; const SKIP_DIRS = new Set(['node_modules', '.git', '__pycache__', '.drafts']); fs.writeFileSync(p, JSON.stringify(obj, null, 2)); fs.writeFileSync(target, String(content ?? ''), 'utf8');

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

src/agent/store.jsView on unpkg

src/main.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = beast-agent@0.25.3 matchedIdentity = npm:YmVhc3QtYWdlbnQ:0.25.3 similarity = 0.907 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/main.jsView on unpkg

5const fs = require('fs'); L6: const http = require('http'); L7: const dns = require('dns'); L8: const crypto = require('crypto'); L9: const { spawn } = require('child_process'); L10: const Engine = require('./agent/engine'); ... L56: if (res.ok) { L57: const j = await res.json(); L58: const v = String(j.version || '').trim(); ... L67: if (win && !win.isDestroyed()) { L68: win.webContents.send('agent:event', { type: 'update', ...updateState, current: app.getVersion() }); L69: }

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

src/main.jsView on unpkg · L5

bin/beast-agent.js#virtual:normalized:round1View file

29L30: /* güncelleme modu: çalışan Beast"i kapat (dosya kilidi EBUSY vermesin) → npm güncelle (görünür ilerleme) → yeniden başlat.\n Bu komut güncelleme butonu tarafından GÖRÜNÜR bir cm... L31: detached: true,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/beast-agent.js#virtual:normalized:round1View on unpkg · L29

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 4

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/beast-agent.js#virtual:normalized:round1View on unpkg

src/agent/scripts/websearch.pyView file

•path = src/agent/scripts/websearch.py kind = build_helper sizeBytes = 7583 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

src/agent/scripts/websearch.pyView on unpkg

eng.traineddataView file

•path = eng.traineddata kind = high_entropy_blob sizeBytes = 5199098 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

eng.traineddataView on unpkg

Source & flagged code

9 flagged · loading source

bin/beast-agent.jsView file

7L8: const { spawn, spawnSync } = require('child_process'); L9: const path = require('path');

High

Child Process

Package source references child process execution.

bin/beast-agent.jsView on unpkg · L7

src/agent/engine.jsView file

High

Shell

Package source references shell execution.

src/agent/engine.jsView on unpkg · L1245

src/agent/store.jsView file

•

Findings

1 Critical7 High4 Medium5 Low

CriticalPrevious Version Dangerous Deltasrc/main.js

HighChild Processbin/beast-agent.js

HighShellsrc/agent/engine.js

HighEntrypoint Foreign Package Code Overwritesrc/agent/store.js

HighCommand Output Exfiltrationsrc/main.js

HighRuntime Package Installbin/beast-agent.js#virtual:normalized:round1

HighShips High Entropy Blobeng.traineddata

HighSemantic Analysis Limitedbin/beast-agent.js#virtual:normalized:round1

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helpersrc/agent/scripts/websearch.py

MediumStructural Risk Force Deep Review

Affected versions and remediation

This report applies to beast-agent@0.24.3.

See all versions of beast-agent for other recorded verdicts.

Review the evidence and your use of beast-agent@0.24.3 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-07 23:37:05.927Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code