registry / freddie / 0.0.142

freddie@0.0.142

Open JS agent harness built on pi-mono, floosie, xstate, and anentrypoint-design

AI Security Review

scanned 2h ago · by lpm-firewall-ai

No confirmed malicious install-time or import-time behavior. The package is an agent harness with user- or model-invoked execution, messaging, integration, and skill-management tools.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Running the CLI/agent and enabling or invoking a relevant tool.

Impact

Requested integrations may send messages, call services, or install skills, but no unsolicited exfiltration, persistence, or foreign control-surface mutation is established.

Mechanism

Explicit tool handlers use configured credentials, local commands, or fixed integration adapters.

Rationale

Static inspection shows an agent framework with broad but package-aligned, invoked capabilities. Scanner findings correspond to configured integration tools and protocol code, not a concrete malicious chain.

Evidence

package.jsonsrc/index.jsbin/freddie.jsplugins/homeassistant_tool/handler.jsplugins/send_message/handler.jsplugins/skills_sync/handler.jsplugins/skills_hub/handler.jssrc/host/index.jssrc/host/host.jssrc/toolsets.jssrc/auth.jsplugins/platform-wecom_crypto/handler.jssrc/cli/uninstall.js

Decision evidence

public snapshot

AI called this Clean at 91.0% confidence as Benign with low false-positive risk.

Evidence for block

`plugins/skills_sync/handler.js` can clone/pull a caller-supplied Git repository into Freddie's own skills directory.
`plugins/send_message/handler.js` dynamically imports only a fixed allowlist of bundled platform adapters.
`plugins/homeassistant_tool/handler.js` sends `HASS_TOKEN` only to the configured Home Assistant URL during an invoked tool action.

Evidence against

`package.json` defines no `preinstall`, `install`, or `postinstall` lifecycle hooks.
`src/index.js` only exports modules; no import-time network, shell, or filesystem action is evident.
`bin/freddie.js` boots the plugin host only when the user runs the CLI.
`plugins/skills_hub/handler.js` fetches its catalog and writes skills only through explicit tool actions.
`plugins/platform-wecom_crypto/handler.js` uses SHA-1/AES-CBC for WeCom protocol compatibility; no credential theft or exfiltration path is shown.
No source inspected writes foreign AI-agent configuration or installs hooks/extensions outside Freddie-managed paths.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

Manifest

WildcardDependency

scanned 418 file(s), 538 KB of source, external domains: 127.0.0.1, api.byterover.com, api.hindsightai.com, api.honcho.dev, api.hunyuan.cloud.tencent.com, api.mem0.ai, api.moonshot.ai, api.moonshot.cn, api.nousresearch.com, api.openviking.com, api.osv.dev, api.retaindb.com, api.sgroup.qq.com, api.spotify.com, api.supermemory.ai, api.telegram.org, api.twilio.com, api.vercel.com, api.weixin.qq.com, api.x.ai, api.z.ai, app.daytona.io, cloudcode-pa.googleapis.com, discord.com, graph.facebook.com, homeassistant.local, html.duckduckgo.com, models.dev, oapi.dingtalk.com, oauth2.googleapis.com, open.bigmodel.cn, open.feishu.cn, openrouter.ai, qyapi.weixin.qq.com, raw.githubusercontent.com, serpapi.com, slack.com, www.apple.com, www.googleapis.com

Source & flagged code

3 flagged

plugins/send_message/handler.jsView file

Lines 1-31javascript

1const PLATFORM_MODULES = {

2 telegram: '../gateway/platforms/telegram.js',

3 discord: '../gateway/platforms/discord.js',

4 slack: '../gateway/platforms/slack.js',

5 whatsapp: '../gateway/platforms/whatsapp.js',

6 email: '../gateway/platforms/email.js',

7 sms: '../gateway/platforms/sms.js',

8 matrix: '../gateway/platforms/matrix.js',

9 signal: '../gateway/platforms/signal.js',

10 mattermost: '../gateway/platforms/mattermost.js',

11}

13export const _tool = ({

14 name: 'send_message',

15 toolset: 'core',

16 schema: { name: 'send_message', description: 'Send a message to a recipient on the named platform. Uses the gateway adapter; requires the platform credentials.', parameters: { type: 'object', properties: { platform: { type: 'string', enum: Object.keys(PLATFORM_MODULES) }, to: { type: 'string' }, text: { type: 'string' } }, required: ['platform', 'to', 'text'] } },

17 handler: async ({ platform, to, text }) => {

18 const mod = PLATFORM_MODULES[platform]

19 if (!mod) return { error: 'unknown platform: ' + platform }

20 const m = await import(mod)

21 const cls = Object.values(m)[0]

Medium

Dynamic Require

Package source references dynamic require/import behavior.

plugins/send_message/handler.jsView on unpkg · L19

22 const inst = new cls({})

23 try { await inst.start() } catch (e) { return { error: String(e.message || e) } }

24 try {

25 const out = await inst.send({ to, text })

26 await inst.stop?.()

27 return { ok: true, response: out }

28 } catch (e) { await inst.stop?.(); return { error: String(e.message || e) } }

29 },

30})

plugins/platform-wecom_crypto/handler.jsView file

Lines 1-17javascript

1import crypto from 'node:crypto'

2export function sha1(...parts) { return crypto.createHash('sha1').update(parts.sort().join('')).digest('hex') }

3export function

plugins/homeassistant_tool/handler.jsView file

Lines 1-15javascript

1export const _tool = ({

2 name: 'homeassistant_tool',

3 toolset: 'core',

4 schema: { name: 'homeassistant_tool', description: 'Read state or call a service on Home Assistant.', parameters: { type: 'object', properties: { action: { type: 'string', enum: ['state', 'service'] }, entity_id: { type: 'string' }, domain: { type: 'string' }, service: { type:

Source & flagged code

3 flagged · loading source

plugins/send_message/handler.jsView file

19if (!mod) return { error: 'unknown platform: ' + platform } L20: const m = await import(mod) L21: const cls = Object.values(m)[0]

Medium

Dynamic Require

Package source references dynamic require/import behavior.

plugins/send_message/handler.jsView on unpkg · L19

plugins/platform-wecom_crypto/handler.jsView file

6export function decryptMsg(encryptedB64, encodingAesKey) { L7: const aesKey = Buffer.from(encodingAesKey + '=', 'base64') L8: const iv = aesKey.slice(0, 16)

Low

Weak Crypto

Package source references weak cryptographic algorithms.

plugins/platform-wecom_crypto/handler.jsView on unpkg · L6

plugins/homeassistant_tool/handler.jsView file

3toolset: 'core', L4: schema: { name: 'homeassistant_tool', description: 'Read state or call a service on Home Assistant.', parameters: { type: 'object', properties: { action: { type: 'string', enum: ['... L5: requiresEnv: ['HASS_TOKEN', 'HASS_URL'], L6: checkFn: () => Boolean(process.env.HASS_TOKEN), L7: handler: async ({ action, entity_id, domain, service, data = {} }) => { L8: const url = process.env.HASS_URL || 'http://homeassistant.local:8123' L9: const auth = { authorization: `Bearer ${process.env.HASS_TOKEN}` } L10: if (action === 'state') return await (await fetch(`${url}/api/states/${entity_id}`, { headers: auth })).json() L11: if (action === 'service') return await (await fetch(`${url}/api/services/${domain}/${service}`, { method: 'POST', headers: { ...auth, 'content-type': 'application/json' }, body: JS...

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

plugins/homeassistant_tool/handler.jsView on unpkg · L3

Findings

1 Critical4 Medium5 Low

CriticalCredential Exfiltrationplugins/homeassistant_tool/handler.js

MediumDynamic Requireplugins/send_message/handler.js

MediumNetwork

MediumEnvironment Vars

MediumWildcard Dependency

LowScripts Present

LowWeak Cryptoplugins/platform-wecom_crypto/handler.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

plugins/send_message/handler.jsView file

Lines 1-31javascript

1const PLATFORM_MODULES = {

2 telegram: '../gateway/platforms/telegram.js',

3 discord: '../gateway/platforms/discord.js',

4 slack: '../gateway/platforms/slack.js',

5 whatsapp: '../gateway/platforms/whatsapp.js',

6 email: '../gateway/platforms/email.js',

7 sms: '../gateway/platforms/sms.js',

8 matrix: '../gateway/platforms/matrix.js',

9 signal: '../gateway/platforms/signal.js',

10 mattermost: '../gateway/platforms/mattermost.js',

11}

13export const _tool = ({

14 name: 'send_message',

15 toolset: 'core',

17 handler: async ({ platform, to, text }) => {

18 const mod = PLATFORM_MODULES[platform]

19 if (!mod) return { error: 'unknown platform: ' + platform }

20 const m = await import(mod)

21 const cls = Object.values(m)[0]

Medium

Dynamic Require

Package source references dynamic require/import behavior.

plugins/send_message/handler.jsView on unpkg · L19

22 const inst = new cls({})

23 try { await inst.start() } catch (e) { return { error: String(e.message || e) } }

24 try {

25 const out = await inst.send({ to, text })

26 await inst.stop?.()

27 return { ok: true, response: out }

28 } catch (e) { await inst.stop?.(); return { error: String(e.message || e) } }

29 },

30})

plugins/platform-wecom_crypto/handler.jsView file

Lines 1-17javascript

1import crypto from 'node:crypto'

2export function sha1(...parts) { return crypto.createHash('sha1').update(parts.sort().join('')).digest('hex') }

3export function

plugins/homeassistant_tool/handler.jsView file

Lines 1-15javascript

1export const _tool = ({

2 name: 'homeassistant_tool',

3 toolset: 'core',