registry  /  fcell2  /  1.0.2

fcell2@1.0.2

FIVO CELL — Unlimited memory AI coding assistant with BM25+TF-IDF retrieval, PII redaction, cost tracking, 3 modes, vault & vibe

AI Security Review

scanned 3d ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. Install-time setup plants a package-supplied agent extension into the package's own global .cell extension directory. The extension can alter agent prompts and manage local memory/vault state when the fcell2/cell agent loads extensions.

Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
npm install lifecycle postinstall, then running the cell/cell2 agent
Impact
Persistent package-owned extension can influence agent context and tool mode within fcell2 sessions; no confirmed exfiltration or foreign agent hijack.
Mechanism
first-party agent extension lifecycle registration
Policy narrative
On install, the package runs a postinstall node snippet that creates ~/.cell/agent/extensions and copies its bundled fivo.ts extension there. The fcell2 runtime uses .cell as its config directory and auto-discovers global extensions from ~/.cell/agent/extensions, so future agent runs can load this extension. The extension adds memory, vault, prompt injection, mode switching, and cost commands, but inspection did not find exfiltration or mutation of foreign AI-agent control surfaces.
Rationale
This is guarded by the package's own .cell platform namespace but still uses lifecycle installation of an agent extension with prompt/control influence. Under the install-control-surface policy this is warn-only agent extension lifecycle risk, not a publish block.
Evidence
package.json.pi/extensions/fivo.tsdist/config.jsdist/core/extensions/loader.jsdist/cli.jsdist/index.js~/.cell/agent/extensions/fivo.ts~/.cell/extensions/fivo.ts~/.cell/memory.json~/.cell/vault.json~/.cell/vibe.md~/.cell/mode.json~/.cell/themes/cell-orange.json

Decision evidence

public snapshot
AI called this Suspicious at 90.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
  • package.json postinstall copies .pi/extensions/fivo.ts into ~/.cell/agent/extensions/fivo.ts
  • package.json postinstall creates ~/.cell/agent/extensions and removes legacy ~/.cell/extensions/fivo.ts
  • dist/config.js derives CONFIG_DIR_NAME from piConfig; package.json sets configDir to .cell
  • dist/core/extensions/loader.js auto-loads global extensions from getAgentDir()/extensions
  • fivo.ts hooks agent events, injects memory/context into prompts, and stores memory/vault/theme under ~/.cell
Evidence against
  • No postinstall network or shell execution beyond node fs copy/remove observed
  • Lifecycle writes are under package-owned .cell namespace, not Claude/Codex/Cursor/MCP foreign surfaces
  • fivo.ts redacts common secrets on input and only displays vault keys as [SET] in prompt context
  • No credential exfiltration endpoint found in inspected lifecycle/extension files
Behavioral surface
Source
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
Supply chain
HighEntropyStringsMinifiedUrlStrings
ManifestNo manifest risk signals triggered.
scanned 263 file(s), 2.30 MB of source, external domains: 127.0.0.1, api.anthropic.com, api.github.com, claude.ai, cli.github.com, cloud.gitlab.com, console.anthropic.com, distro.ibiblio.org, getcell.dev, git-scm.com, github.com, gitlab.com, mariozechner.at, mistral.ai

Source & flagged code

7 flagged · loading source
package.jsonView file
•scripts.postinstall = node -e "const{cpSync,mkdirSync,rmSync,existsSync}=require('fs');const{join}=require('path');const{homedir}=require('os');const d=join(homedir(),'.cell','agent','extensions');mkdir...
Critical
Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg
•scripts.postinstall = node -e "const{cpSync,mkdirSync,rmSync,existsSync}=require('fs');const{join}=require('path');const{homedir}=require('os');const d=join(homedir(),'.cell','agent','extensions');mkdir...
High
Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg
examples/extensions/doom-overlay/doom-engine.tsView file
64const nativeRequire = createRequire(doomJsPath); L65: const moduleFunc = new Function("module", "exports", "__dirname", "__filename", "require", doomJsCode); L66: moduleFunc(moduleExports, moduleExports.exports, buildDir, doomJsPath, nativeRequire);
Low
Eval

Package source references a known benign dynamic code generation pattern.

examples/extensions/doom-overlay/doom-engine.tsView on unpkg · L64
dist/core/extensions/loader.jsView file
52}; L53: const require = createRequire(import.meta.url); L54: /**
Medium
Dynamic Require

Package source references dynamic require/import behavior.

dist/core/extensions/loader.jsView on unpkg · L52
examples/extensions/doom-overlay/doom/build/doom.wasmView file
•path = examples/extensions/doom-overlay/doom/build/doom.wasm kind = wasm_module sizeBytes = 380169 magicHex = [redacted]
Medium
Ships Wasm Module

Package ships WebAssembly modules.

examples/extensions/doom-overlay/doom/build/doom.wasmView on unpkg
examples/extensions/doom-overlay/doom/build.shView file
•path = examples/extensions/doom-overlay/doom/build.sh kind = build_helper sizeBytes = 3366 magicHex = [redacted]
Medium
Ships Build Helper

Package ships non-JavaScript build or shell helper files.

examples/extensions/doom-overlay/doom/build.shView on unpkg
dist/modes/interactive/interactive-mode.jsView file
•matchType = previous_version_dangerous_delta matchedPackage = fcell2@0.0.9 matchedIdentity = npm:ZmNlbGwy:0.0.9 similarity = 0.992 summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/modes/interactive/interactive-mode.jsView on unpkg

Findings

2 Critical1 High6 Medium6 Low
CriticalRed Install Lifecycle Scriptpackage.json
CriticalPrevious Version Dangerous Deltadist/modes/interactive/interactive-mode.js
HighInstall Time Lifecycle Scriptspackage.json
MediumDynamic Requiredist/core/extensions/loader.js
MediumNetwork
MediumEnvironment Vars
MediumShips Wasm Moduleexamples/extensions/doom-overlay/doom/build/doom.wasm
MediumShips Build Helperexamples/extensions/doom-overlay/doom/build.sh
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvalexamples/extensions/doom-overlay/doom-engine.ts
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings