caitlyn@0.7.0
CAITLYN Security Guardian Agent — interactive defense agent for LLM agent protection
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe package has a conditional relay path that forwards configured provider credentials and prompts to api.aicodemirror.ai for specific model IDs. Because this requires choosing a matching model and the default configuration uses a different provider/model path, this is a serious but conditional credential-handling risk rather than established automatic exfiltration.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A user configures a matching provider and one of the hard-coded relay model IDs, then makes an LLM request.
Impact
The relay receives the provider credential and prompt content, creating risk of credential exposure and access to the provider account.
Mechanism
Model resolution overrides the provider model's base URL to api.aicodemirror.ai; the LLM runtime supplies the configured provider credential to that request.
AI rationale
The package has a conditional relay path that forwards configured provider credentials and prompts to api.aicodemirror.ai for specific model IDs. Because this requires choosing a matching model and the default configuration uses a different provider/model path, this is a serious but conditional credential-handling risk rather than established automatic exfiltration.
Evidence
dist/llm.jsdist/llm-runtime.jsdist/config.js
Network endpoints1
api.aicodemirror.ai
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- For a small hard-coded set of model IDs, resolveModel routes Anthropic, OpenAI, or Google requests through the AICodeMirror relay.
- The LLM runtime resolves the configured provider credential and passes it to the completion request using that model.
- The configured request includes the user prompt and system prompt, so the relay receives them along with the provider credential.
Evidence against
- The default configuration uses OpenRouter with deepseek/deepseek-v4-flash; it does not select a relay model by default.
- The relay path is conditional on the configured provider and an exact model ID match.
- The manifest declares no install, preinstall, or postinstall hook; its prepublishOnly script runs tests and an audit.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
6 flaggeddist/scanner.jsView file
13*/
L14: import { spawn } from "node:child_process";
L15: import * as fs from "node:fs";
High
dist/scripts/tier0-worker.mjsView file
37try {
L38: const mod = await import(pathToFileURL(file).href);
L39: if (typeof mod.detect === "function") detectors.set(id, mod.detect);
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/scripts/tier0-worker.mjsView on unpkg · L37dist/sync/update.jsView file
4* Discovery source of truth: GitHub release tag.
L5: * Apply path for v1: npm install of the configured package.
L6: */
L7: import { spawnSync } from "node:child_process";
L8: import * as fs from "node:fs";
Findings
1 Critical4 High5 Medium5 Low
CriticalPrevious Version Dangerous Deltadist/components/host-watch-live.js
HighChild Processdist/scanner.js
HighShell
HighRuntime Package Installdist/sync/update.js
HighSemantic Analysis Limiteddist/adapters/registry.js#virtual:normalized:round1
MediumDynamic Requiredist/scripts/tier0-worker.mjs
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperextension/caitlyn-helpers.py
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to caitlyn@0.7.0.
See all versions of caitlyn for other recorded verdicts.
- Review the evidence and your use of caitlyn@0.7.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.