registry / bmem-cli / 0.1.0

bmem-cli@0.1.0

Open catalog of web skills for AI agents. Search, add, and run reusable browser recipes with whatever browser your agent already has.

AI Security Review

scanned 6h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

One or more suspicious static signals were detected.

Trigger

User runs bmem add <name> or bmem install.

Impact

May add first-party or catalog-provided skills to local agent skill configuration with user intent.

Mechanism

downloads/registers agent skills via npx skills add

Rationale

This matches an explicit user-command agent capability setup with remote catalog content, so it warrants a warning but not a publish block. There is no unconsented npm install-time mutation or source evidence of malicious behavior.

Evidence

package.jsondist/index.jsREADME.mdskills/bmem/SKILL.md$BMEM_HOME/skills/<skill-id>

Network endpoints2

api.browser-memory.commanifest-provided file.url values

Decision evidence

public snapshot

AI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

dist/index.js exposes user-invoked add/install commands that run npx --yes skills add.
dist/index.js install registers bundled skills/bmem globally with --agent *.
dist/index.js add downloads manifest-listed files from remote URLs into BMEM_HOME before registering them as native skills.

Evidence against

package.json has only prepare build script; no preinstall/install/postinstall agent mutation.
Network use is package-aligned catalog access via API_BASE default https://api.browser-memory.com.
No credential harvesting, exfiltration headers, eval/vm/Function, native binary loading, or persistence beyond explicit skill registration found.
parseSkillId rejects backslashes, dot segments, and more than two path parts.

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 7.27 KB of source, external domains: api.browser-memory.com, nodejs.org

Source & flagged code

3 flagged

dist/index.jsView file

Lines 23-113javascript

23 return res.json();

24}

25async function searchSkills(q, site) {

26 const params = new URLSearchParams();

27 if (q) params.set("q", q);

28 if (site) params.set("site", site);

29 const qs = params.toString();

30 const data = await getJSON(

31 `${API_BASE}/v1/skills${qs ? `?${qs}` : ""}`

32 );

33 return data.skills ?? [];

34}

35function getManifest(name) {

36 return getJSON(`${API_BASE}/v1/skills/${name}/files`);

37}

38async function fetchBinary(url) {

39 const res = await fetch(url);

40 if (!res.ok) throw new HttpError(res.status, url, res.statusText);

41 return new Uint8Array(await res.arrayBuffer());

42}

43async function fetchText(url) {

44 const res = await fetch(url);

45 if (!res.ok) throw new HttpError(res.status, url, res.statusText);

46 return res.text();

47}

49// src/install.ts

50import { spawn } from "child_process";

51import { mkdir, mkdtemp, rename, rm, writeFile } from "fs/promises";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L49

52import { dirname, join as join2 } from "path";

54// src/paths.ts

55import { homedir } from "os";

56import { join } from "path";

57var BMEM_HOME = process.env.BMEM_HOME ?? join(process.env.XDG_CONFIG_HOME ?? join(homedir(), ".config"), "bmem");

58var BMEM_SKILLS_DIR = join(BMEM_HOME, "skills");

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L43

60// src/install.ts

61function parseSkillId(raw) {

62 const parts = raw.split("/").filter(Boolean);

63 if (raw.includes("\\") || parts.length < 1 || parts.length > 2 || parts.some((s) => s === "." || s === "..")) {

64 throw new Error(`invalid skill id "${raw}". Use <site> or <site>/<task>.`);

65 }

66 const [domain, task = ""] = parts;

67 return { domain, task, id: parts.join("/") };

68}

69async function downloadSkill(id) {

73 await mkdir(parent, { recursive: true });

74 const tmp = await mkdtemp(join2(parent, `.${id.domain}-`));

75 try {

76 for (const file of manifest.files) {

77 const bytes = await fetchBinary(file.url);

78 const out = join2(tmp, file.path);

79 await mkdir(dirname(out), { recursive: true });

80 await writeFile(out, bytes);

81 }

82 await rm(installPath, { recursive: true, force: true });

83 await rename(tmp, installPath);

84 } catch (err) {

85 await rm(tmp, { recursive: true, force: true });

86 throw err;

87 }

88 return installPath;

89}

90async function runSkillsAdd(path, extraArgs = []) {

91 const code = await spawnInherit("npx", ["--yes", "skills", "add", path, ...extraArgs]);

92 if (code !== 0) {

93 throw new Error(

94 `\`npx skills add\` exited with code ${code}. Make sure Node.js/npx is installed (https://nodejs.org).`

95 );

96 }

97}

98function spawnInherit(cmd, args) {

99 return new Promise((resolve) => {

100 const child = spawn(cmd, args, { stdio: "inherit" });

101 child.on("error", () => resolve(1));

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.jsView on unpkg · L93

102 child.on("close", (code) => resolve(code ?? 0));

103 });

104}

105

106// src/commands/add.ts

107async function addCommand(name) {

108 const id = parseSkillId(name);

109 let installPath;

110 try {

111 installPath = await downloadSkill(id);

112 } catch (err) {

113 if (err instanceof HttpError && err.status === 404) {

Source & flagged code

3 flagged · loading source

dist/index.jsView file

49// src/install.ts L50: import { spawn } from "child_process"; L51: import { mkdir, mkdtemp, rename, rm, writeFile } from "fs/promises";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L49

43async function fetchText(url) { L44: const res = await fetch(url); L45: if (!res.ok) throw new HttpError(res.status, url, res.statusText); ... L49: // src/install.ts L50: import { spawn } from "child_process"; L51: import { mkdir, mkdtemp, rename, rm, writeFile } from "fs/promises"; ... L56: import { join } from "path"; L57: var BMEM_HOME = process.env.BMEM_HOME ?? join(process.env.XDG_CONFIG_HOME ?? join(homedir(), ".config"), "bmem"); L58: var BMEM_SKILLS_DIR = join(BMEM_HOME, "skills");

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L43

93throw new Error( L94: `\`npx skills add\` exited with code ${code}. Make sure Node.js/npx is installed (https://nodejs.org).` L95: ); ... L99: return new Promise((resolve) => { L100: const child = spawn(cmd, args, { stdio: "inherit" }); L101: child.on("error", () => resolve(1));

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.jsView on unpkg · L93

Findings

4 High2 Medium4 Low

HighChild Processdist/index.js

HighShell

HighSame File Env Network Executiondist/index.js

HighRuntime Package Installdist/index.js

MediumNetwork

MediumEnvironment Vars

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowUrl Strings

Source & flagged code

3 flagged

dist/index.jsView file

Lines 23-113javascript

23 return res.json();

24}

25async function searchSkills(q, site) {

26 const params = new URLSearchParams();

27 if (q) params.set("q", q);

28 if (site) params.set("site", site);

29 const qs = params.toString();

30 const data = await getJSON(

31 `${API_BASE}/v1/skills${qs ? `?${qs}` : ""}`

32 );

33 return data.skills ?? [];

34}

35function getManifest(name) {

36 return getJSON(`${API_BASE}/v1/skills/${name}/files`);

37}

38async function fetchBinary(url) {

39 const res = await fetch(url);

40 if (!res.ok) throw new HttpError(res.status, url, res.statusText);

41 return new Uint8Array(await res.arrayBuffer());

42}

43async function fetchText(url) {

44 const res = await fetch(url);

45 if (!res.ok) throw new HttpError(res.status, url, res.statusText);

46 return res.text();

47}

49// src/install.ts

50import { spawn } from "child_process";

51import { mkdir, mkdtemp, rename, rm, writeFile } from "fs/promises";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L49

52import { dirname, join as join2 } from "path";

54// src/paths.ts

55import { homedir } from "os";

56import { join } from "path";

57var BMEM_HOME = process.env.BMEM_HOME ?? join(process.env.XDG_CONFIG_HOME ?? join(homedir(), ".config"), "bmem");

58var BMEM_SKILLS_DIR = join(BMEM_HOME, "skills");

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L43

60// src/install.ts

61function parseSkillId(raw) {

62 const parts = raw.split("/").filter(Boolean);

63 if (raw.includes("\\") || parts.length < 1 || parts.length > 2 || parts.some((s) => s === "." || s === "..")) {

64 throw new Error(`invalid skill id "${raw}". Use <site> or <site>/<task>.`);

65 }

66 const [domain, task = ""] = parts;

67 return { domain, task, id: parts.join("/") };

68}

69async function downloadSkill(id) {

73 await mkdir(parent, { recursive: true });

74 const tmp = await mkdtemp(join2(parent, `.${id.domain}-`));

75 try {

76 for (const file of manifest.files) {

77 const bytes = await fetchBinary(file.url);

78 const out = join2(tmp, file.path);

79 await mkdir(dirname(out), { recursive: true });

80 await writeFile(out, bytes);

81 }

82 await rm(installPath, { recursive: true, force: true });

83 await rename(tmp, installPath);

84 } catch (err) {

85 await rm(tmp, { recursive: true, force: true });

86 throw err;

87 }

88 return installPath;

89}

90async function runSkillsAdd(path, extraArgs = []) {

91 const code = await spawnInherit("npx", ["--yes", "skills", "add", path, ...extraArgs]);

92 if (code !== 0) {

93 throw new Error(

94 `\`npx skills add\` exited with code ${code}. Make sure Node.js/npx is installed (https://nodejs.org).`

95 );

96 }

97}

98function spawnInherit(cmd, args) {

99 return new Promise((resolve) => {

100 const child = spawn(cmd, args, { stdio: "inherit" });

101 child.on("error", () => resolve(1));

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.jsView on unpkg · L93

102 child.on("close", (code) => resolve(code ?? 0));

103 });

104}

105

106// src/commands/add.ts

107async function addCommand(name) {

108 const id = parseSkillId(name);

109 let installPath;

110 try {

111 installPath = await downloadSkill(id);

112 } catch (err) {

113 if (err instanceof HttpError && err.status === 404) {