registry / commandmate / 0.11.1

commandmate@0.11.1

AI Security Review

scanned 3h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User starts an OpenCode agent session through CommandMate.

Impact

User-invoked agent configuration and command-execution capability within the selected worktree.

Mechanism

worktree agent-config creation plus tmux command delivery

Rationale

Source inspection found a user-triggered worktree agent-config mutation and tmux control capability, but no concrete malware behavior. Per policy, this merits a warning rather than a block.

Evidence

package.jsonbin/commandmate.jsdist/cli/commands/update.jsdist/cli/utils/npm-runner.jsdist/cli/utils/npx-runner.jsdist/server/src/lib/cli-tools/opencode-config.jsdist/server/src/lib/cli-tools/opencode.jsdist/server/src/lib/tmux/tmux.js.next/server/app/apple-icon.png.body.next/server/app/api/worktrees/[id]/marp-render/route.jsopencode.json

Network endpoints3

/api/tags

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

`dist/server/src/lib/cli-tools/opencode-config.js` writes worktree-local `opencode.json`.
The config write is triggered while starting an OpenCode session in `dist/server/src/lib/cli-tools/opencode.js`.
`dist/server/src/lib/tmux/tmux.js` sends supplied keys to tmux agent sessions.

Evidence against

`package.json` has no `preinstall`, `install`, or `postinstall` hook.
`bin/commandmate.js` executes only when the user invokes the CLI.
OpenCode setup preserves existing config and writes only after local-provider discovery.
Observed fetches target localhost services, the local daemon, or the package's GitHub release endpoint.
`.next/server/app/apple-icon.png.body` is a normal PNG; the large Marp route is a compiled bundle.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStrings

Source & flagged code

4 flagged

.next/server/app/apple-icon.png.bodyView file

•path = .next/server/app/apple-icon.png.body kind = high_entropy_blob sizeBytes = 11287 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

.next/server/app/apple-icon.png.bodyView on unpkg

•path = .next/server/app/apple-icon.png.body kind = payload_in_excluded_dir sizeBytes = 11287 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.next/server/app/apple-icon.png.bodyView on unpkg

.next/server/app/api/worktrees/[id]/marp-render/route.jsView file

•path = .next/server/app/api/worktrees/[id]/marp-render/route.js kind = oversized_source_file sizeBytes = 3569260 magicHex = [redacted]

Source & flagged code

4 flagged · loading source

.next/server/app/apple-icon.png.bodyView file

•path = .next/server/app/apple-icon.png.body kind = high_entropy_blob sizeBytes = 11287 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

.next/server/app/apple-icon.png.bodyView on unpkg

•path = .next/server/app/apple-icon.png.body kind = payload_in_excluded_dir sizeBytes = 11287 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.next/server/app/apple-icon.png.bodyView on unpkg

.next/server/app/api/worktrees/[id]/marp-render/route.jsView file

•path = .next/server/app/api/worktrees/[id]/marp-render/route.js kind = oversized_source_file sizeBytes = 3569260 magicHex = [redacted]

Findings

4 High3 Medium6 Low

HighShips High Entropy Blob.next/server/app/apple-icon.png.body

HighPayload In Excluded Dir.next/server/app/apple-icon.png.body

HighOversized Source File.next/server/app/api/worktrees/[id]/marp-render/route.js

HighPrevious Version Dangerous Deltadist/cli/commands/update.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License