registry / engine7 / 7.1.53

engine7@7.1.53

Engine 7 — 给助手一个家 / A home for your AI assistant

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

No unconsented install-time attack surface was confirmed. Runtime network, shell, and persistence features are activated through the package's CLI or agent functions.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

A user runs engine7 commands or enables its configured agent tools.

Impact

The agent can use configured credentials and perform enabled local actions, but no malicious exfiltration or automatic persistence was found.

Mechanism

User-configured agent tooling and optional service setup.

AI rationale

This is a capable AI-agent runtime, but its sensitive actions are runtime or explicit CLI features rather than installation behavior. Source inspection found no concrete malicious chain or unconsented foreign control-surface mutation.

Evidence

package.jsonbin/engine7dist/cli.mjsdist/main.mjsdist/engine-startup.mjs$HOME/.engine7-secrets/main7.env$HOME/.config/systemd/user/engine7.serviceengine7-start.cmd

Network endpoints1

api.tavily.com/search

Decision evidence

public snapshot

AI called this Clean at 86.0% confidence as Benign with medium false-positive risk.

Evidence for AI clean decision

The runtime web-search tool sends a configured Tavily API key to api.tavily.com.
An explicit service install command can create an Engine7 user auto-start service.

Evidence against

package.json has no preinstall, install, or postinstall hook.
The executable only imports the CLI; setup, key storage, and service creation require explicit CLI actions.
No self-dependency, hidden download-and-execute path, or unconsented foreign agent configuration write was found.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 7 file(s), 2.66 MB of source, external domains: 127.0.0.1, accounts.feishu.cn, accounts.larksuite.com, api.anthropic.com, api.deepinfra.com, api.deepseek.com, api.github.com, api.minimaxi.com, api.moonshot.cn, api.tavily.com, api.x.ai, dashscope.aliyuncs.com, fal.run, github.com, ilinkai.weixin.qq.com, novac2c.cdn.weixin.qq.com, open.bigmodel.cn, open.feishu.cn, primeradiant.com, www.apple.com

Source & flagged code

16 flagged

dist/engine-startup.mjsView file

3845READ_TIMEOUT_MS = 6e4; L3846: FIRST_READ_TIMEOUT_MS = parseInt(process.env.API_TIMEOUT_MS || "", 10) || 6e5; L3847: proxyAgentCache = /* @__PURE__ */ new Map(); ... L3858: }); L3859: import { spawn as spawn2 } from "child_process"; L3860: import net from "net"; L3861: import path6 from "path";

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

dist/engine-startup.mjsView on unpkg · L3845

265try { L266: const raw = JSON.parse(fs2.readFileSync(filePath, "utf-8")); L267: loadHooksFromConfig(raw); ... L369: // src/hooks/executor.ts L370: import { spawn } from "child_process"; L371: import { randomUUID } from "node:crypto"; L372: function parseHookOutput(stdout) { L373: const trimmed = stdout.trim(); ... L450: const envVars = { L451: ...process.env, L452: CLAUDE_PROJECT_DIR: ctx.workspace ... L454: const command = hook.command;

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/engine-startup.mjsView on unpkg · L265

369// src/hooks/executor.ts L370: import { spawn } from "child_process"; L371: import { randomUUID } from "node:crypto";

High

Child Process

Package source references child process execution.

dist/engine-startup.mjsView on unpkg · L369

3630filesystem: true, L3631: shell: true, L3632: memory: true,

High

Shell

Package source references shell execution.

dist/engine-startup.mjsView on unpkg · L3630

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/engine-startup.mjsView on unpkg · L265

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/engine-startup.mjsView on unpkg · L265

dist/cli.mjsView file

Lines 3-43javascript

3var __getOwnPropNames = Object.getOwnPropertyNames;

4var __esm = (fn, res, err) => function __init() {

5 if (err) throw err[

dist/main.mjsView file

99Trigger-reachable chain: scripts.start -> dist/main.mjs L99: try { L100: const raw = JSON.parse(fs48.readFileSync(cfgPath, "utf-8")); L101: const keys = dotPath.split("."); ... L136: filesystem: true, L137: shell: true, L138: memory: true, ... L496: import { randomUUID } from "node:crypto"; L497: function parseHookOutput(stdout) { L498: const trimmed = stdout.trim(); ... L575: const envVars = { L576: ...process.env, L577: CLAUDE_PROJECT_DIR: ctx.workspace

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/main.mjsView on unpkg · L99

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/main.mjs: fs48.writeFileSync(cfgPath, JSON.stringify(raw, null, 2) + "\n", "utf-8"); fs4.writeFileSync(dumpPath, [systemStable, systemDynamic].join("\n\n"), "utf-8"); fs4.writeFileSync(path3.join(opts.workspace, ".context-debug.txt"), lines.join("\n") + "\n", "utf-8"); if (process.env.CLAUDE_CODE_MAX_RETRIES) { return parseInt(process.env.CLAUDE_CODE_MAX_RETRIES, 10); fs14.writeFileSync(outputPath, "", "utf-8"); import { mkdirSync as mkdirSync6, readFileSync as readFileSync12, writeFileSync as writeFileSync8 } from "node:fs"; import { mkdir, readFile, rm, writeFile } from "node:fs/promises";

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/main.mjsView on unpkg

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. dist/main.mjs: fs48.writeFileSync(cfgPath, JSON.stringify(raw, null, 2) + "\n", "utf-8"); The following MCP servers have provided instructions for how to use their tools and resources: parts.push(`The following MCP servers have disconnected: fs4.writeFileSync(dumpPath, [systemStable, systemDynamic].join("\n\n"), "utf-8"); fs4.writeFileSync(path3.join(opts.workspace, ".context-debug.txt"), lines.join("\n") + "\n", "utf-8"); function getCompactUserSummaryMessage(summary, suppressFollowUpQuestions) { if (suppressFollowUpQuestions) { - Your entire response must be plain text: an <analysis> block followed by a <summary> block.

bin/engine7.cmdView file

•path = bin/engine7.cmd kind = build_helper sizeBytes = 42 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/engine7.cmdView on unpkg

templates/skills/superpowers/brainstorming/scripts/server.cjsView file

•matchType = normalized_sha256 matchedPackage = @brainervirus/workit-opencode@0.8.5 matchedPath = [redacted].cjs matchedIdentity = npm:[redacted]:0.8.5 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

templates/skills/superpowers/brainstorming/scripts/server.cjsView on unpkg

templates/skills/superpowers/writing-skills/render-graphs.jsView file

•matchType = normalized_sha256 matchedPackage = @abblor/agent-os@0.11.0 matchedPath = skills/writing-skills/render-graphs.js matchedIdentity = npm:QGFiYmxvci9hZ2VudC1vcw:0.11.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

templates/skills/superpowers/writing-skills/render-graphs.jsView on unpkg

Source & flagged code

16 flagged · loading source

dist/engine-startup.mjsView file

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

dist/engine-startup.mjsView on unpkg · L3845

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/engine-startup.mjsView on unpkg · L265

369// src/hooks/executor.ts L370: import { spawn } from "child_process"; L371: import { randomUUID } from "node:crypto";

Findings

3 Critical10 High5 Medium6 Low

CriticalSame File Env Network Executiondist/engine-startup.mjs

CriticalCredential Exfiltrationdist/engine-startup.mjs

CriticalTrigger Reachable Dangerous Capabilitydist/main.mjs

HighChild Processdist/engine-startup.mjs

HighShelldist/engine-startup.mjs

HighCredential Redirect Persistencedist/main.mjs

HighEntrypoint Foreign Package Code Overwritedist/main.mjs

HighCommand Output Exfiltrationdist/engine-startup.mjs

HighCross File Remote Execution Contextdist/cli.mjs

HighTrigger Reachable Credential Exfiltrationdist/main.mjs

HighTrigger Reachable Persistencedist/cli.mjs

Affected versions and remediation

This report applies to engine7@7.1.53.

See version security history for other recorded verdicts.

Review the evidence and your use of engine7@7.1.53 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-08-28 10:41:26.306Z (UTC).