registry / flowmind / 1.5.4

flowmind@1.5.4

Memory and workflow automation for MCP, Codex, and Claude Code. Reuse repeatable developer operations through skills and explicit feedback.

AI Security Review

scanned 2h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User runs a FlowMind SDD synchronization or auto-flow workflow without an explicit transport, or starts the package's MCP server and calls a FlowMind workflow.

Impact

Can access a locally logged MCP endpoint and headers and use them to invoke the recovered workflow MCP server with FlowMind-supplied tool arguments.

Mechanism

Reads Claude debug logs to recover an MCP transport and forwards FlowMind workflow calls over HTTP.

Rationale

Static inspection resolves this as a user-invoked agent-facing capability with an unnecessary cross-agent debug-log discovery path. The package lacks install-time execution, foreign control-surface mutation, persistence, credential exfiltration, remote-code loading, and payload obfuscation evidence required for a malware or publish-block decision. The explicit runtime update and CLI subprocess features are not independently malicious, but the Claude debug-log parsing and reuse of recovered MCP headers creates a concrete unsafe integration surface; warn rather than block.

Evidence

package.jsoncore/sdd-agent-sync.jscore/mcp-http-client.jsskills/auto-flow/index.jsbin/flowmind.jsmcp/server.jscore/skill-loader.js~/.claude/debug

Decision evidence

public snapshot

AI called this Suspicious at 89.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

`core/sdd-agent-sync.js` reads up to ten recent files in `~/.claude/debug` and parses a `friday-auto-flow` MCP HTTP transport, including its headers, when no explicit transport or `FLOWMIND_AUTO_FLOW_MCP_URL` is supplied.
`core/mcp-http-client.js` sends caller-provided tool names and arguments to the discovered/configured transport URL with the discovered headers.
`bin/flowmind.js` includes user-invoked shell execution: it runs `npm view` / `npm install` for the explicit `update` command, runs `gh gist create` for the explicit `--gist` export option, and opens an editor selected by `EDITOR` or `VISUAL`.
`mcp/server.js` exposes FlowMind skills through a stdio MCP server, allowing a connected AI-agent client to trigger package-defined workflows.

Evidence against

`package.json` contains no `preinstall`, `install`, or `postinstall` lifecycle script, so the package does not activate these behaviors during ordinary npm installation.
No inspected file writes `.mcp.json`, `CLAUDE.md`, `.claude/commands`, Codex/Cursor settings, shell startup files, VCS hooks, or OS persistence locations.
The `.claude` access in `core/sdd-agent-sync.js` is a runtime read of debug logs, not a write or registration into Claude's control surface.
No `eval`, `Function`, `vm`, encoded-payload decoder, remote JavaScript loader, or detached-process execution was found in the inspected JavaScript source.
The dynamic `require` sites load local skill/config files from package-controlled paths; the network clients target configured AI/MCP endpoints rather than fetching executable code.

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 82 file(s), 446 KB of source, external domains: aip.baidubce.com, api.anthropic.com, api.deepseek.com, api.mimo.ai, api.openai.com, cli.github.com, dashscope.aliyuncs.com, open.bigmodel.cn, yapi.example.com

Source & flagged code

6 flagged

bin/flowmind.jsView file

Lines 1-33javascript

1#!/usr/bin/env node

3/**

4 * FlowMind CLI

5 * The AI Agent That Learns How You Work

6 */

8const { program } = require('commander');

9const chalk = require('chalk');

10const ora = require('ora');

11const inquirer = require('inquirer');

12const fs = require('fs-extra');

13const path = require('path');

14const { execSync } = require('child_process');

15const FlowMind = require('../core');

High

Child Process

Package source references child process execution.

bin/flowmind.jsView on unpkg · L13

16const HonorEngine = require('../core/honor-engine');

17const { syncSddAgentToFlowMind } = require('../core/sdd-agent-sync');

18const { detectManagedCliHost, shouldUseAsciiUi, shouldProxyInkStdin, getNestedTuiGuardMessage } = require('../core/utils');

19const { isExitCommand } = require('../tui/ui');

21/**

22 * Restore terminal to sane state (cancel raw mode, show cursor, reset colors)

23 */

24function restoreTerminal() {

25 try {

26 if (process.stdin.isTTY && typeof process.stdin.setRawMode === 'function') {

27 process.stdin.setRawMode(false);

28 }

29 } catch (e) { /* ignore */ }

30 if (process.stdout.isTTY) {

31 // Show cursor, reset colors, clear scroll region

32 process.stdout.write('\x1b[?25h\x1b[0m\x1b[r');

33 }

Lines 1569-1609javascript

1569

1570 console.log(chalk.cyan('└─────────────────────────────────────────────────────┘'));

1571}

1572

1573function formatFileSize(bytes) {

1574 if (bytes === 0) return '0 B';

1575 const k = 1024

Lines 1839-1879javascript

1839 // Compare versions

1840 const parse = (v) => v.split('.').map(Number);

1841 const curr = parse(currentVersion);

1842 const latest = parse(latestVersion);

1843

•matchType = previous_version_dangerous_delta matchedPackage = flowmind@1.5.3 matchedIdentity = npm:Zmxvd21pbmQ:1.5.3 similarity = 0.817 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

bin/flowmind.jsView on unpkg

core/honor-engine.jsView file

Lines 1-25javascript

1/**

2 * FlowMind Honor Engine

3 * Tracks honor points earned through usage and manages dragon totem levels

4 */

6const fs = require('fs-extra');

7const path = require('path');

Medium

Dynamic Require

demo/common.shView file

•path = demo/common.sh kind = build_helper sizeBytes = 579 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

demo/common.shView on unpkg

Source & flagged code

6 flagged · loading source

bin/flowmind.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

bin/flowmind.jsView on unpkg

13const path = require('path'); L14: const { execSync } = require('child_process'); L15: const FlowMind = require('../core');

High

Child Process

Package source references child process execution.

bin/flowmind.jsView on unpkg · L13

1589stdio: 'inherit', L1590: shell: true L1591: });

High

Shell

Package source references shell execution.

bin/flowmind.jsView on unpkg · L1589

1859try { L1860: const globalRoot = execSync('npm root -g', { encoding: 'utf-8' }).trim(); L1861: const localPath = require.resolve('../package.json'); ... L1866: const installCmd = isGlobal L1867: ? `npm install -g flowmind@${latestVersion}` L1868: : `npm install flowmind@${latestVersion}`;

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/flowmind.jsView on unpkg · L1859

core/honor-engine.jsView file

5L6: const fs = require('fs-extra'); L7: const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

core/honor-engine.jsView on unpkg · L5

demo/common.shView file

•path = demo/common.sh kind = build_helper sizeBytes = 579 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

demo/common.shView on unpkg

Findings

1 Critical3 High5 Medium4 Low

CriticalPrevious Version Dangerous Deltabin/flowmind.js

HighChild Processbin/flowmind.js

HighShellbin/flowmind.js

HighRuntime Package Installbin/flowmind.js

MediumDynamic Requirecore/honor-engine.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperdemo/common.sh

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

89%Warn

Verdict confidence

IntentDangerous Capability

TypeAI-agent capability abuse

False-positive riskLow

Review stagedeep_manual_review

Firewall policyWarn-only AI-agent capability risk

Package metadata

npm

AuthorFlowMind Technologies

Maintainersmacheng11

Version1.5.13

PublishedJul 1, 2026

LicenseMIT

Dependencies10

Integrityverified

Package size620 KB

Files122

Keywordsmcpmodel-context-protocolcodexclaude-codeai-agentdeveloper-toolscliworkflow-automation

LinksRepository Homepage Issues

Runtime surface

package.json

Entrypointsmain → core/index.jsbin → flowmind, flowmind-codex, flowmind-mcp

Runtimenode >=18.0.0

Artifact1.09 MB · 122 files1 signature(s)

Install lifecycleNo install hooks · other: build, dev, lint, mcp +3

Behavioral surface

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShellHighEntropyStringsUrlStringsManifest: clean

Source & flagged code

6 flagged

bin/flowmind.jsView file

Lines 1-33javascript

1#!/usr/bin/env node

3/**

4 * FlowMind CLI

5 * The AI Agent That Learns How You Work

6 */

8const { program } = require('commander');

9const chalk = require('chalk');

10const ora = require('ora');

11const inquirer = require('inquirer');

12const fs = require('fs-extra');

13const path = require('path');

14const { execSync } = require('child_process');

15const FlowMind = require('../core');

High

Child Process

Package source references child process execution.

bin/flowmind.jsView on unpkg · L13

16const HonorEngine = require('../core/honor-engine');

17const { syncSddAgentToFlowMind } = require('../core/sdd-agent-sync');

18const { detectManagedCliHost, shouldUseAsciiUi, shouldProxyInkStdin, getNestedTuiGuardMessage } = require('../core/utils');

19const { isExitCommand } = require('../tui/ui');

21/**

22 * Restore terminal to sane state (cancel raw mode, show cursor, reset colors)

23 */

24function restoreTerminal() {

25 try {

26 if (process.stdin.isTTY && typeof process.stdin.setRawMode === 'function') {

27 process.stdin.setRawMode(false);

28 }

29 } catch (e) { /* ignore */ }

30 if (process.stdout.isTTY) {

31 // Show cursor, reset colors, clear scroll region

32 process.stdout.write('\x1b[?25h\x1b[0m\x1b[r');

33 }

Lines 1569-1609javascript

1569

1570 console.log(chalk.cyan('└─────────────────────────────────────────────────────┘'));

1571}

1572

1573function formatFileSize(bytes) {

1574 if (bytes === 0) return '0 B';

1575 const k = 1024

Lines 1839-1879javascript

1839 // Compare versions

1840 const parse = (v) => v.split('.').map(Number);

1841 const curr = parse(currentVersion);

1842 const latest = parse(latestVersion);

1843

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

bin/flowmind.jsView on unpkg

core/honor-engine.jsView file

Lines 1-25javascript

1/**

2 * FlowMind Honor Engine

3 * Tracks honor points earned through usage and manages dragon totem levels

4 */

6const fs = require('fs-extra');

7const path = require('path');

Medium

Dynamic Require

demo/common.shView file

•path = demo/common.sh kind = build_helper sizeBytes = 579 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

demo/common.shView on unpkg