registry / freddie / 0.0.122

freddie@0.0.122

Open JS agent harness built on pi-mono, floosie, xstate, and anentrypoint-design

AI Security Review

scanned 13d ago · by lpm-firewall-ai

No confirmed malicious attack surface is established by source inspection. Risky primitives are aligned with an AI agent CLI and appear activated by explicit CLI/tool use rather than install or import.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

User invokes freddie CLI or enables/calls specific agent tools.

Impact

Could access configured services or local files when the user/agent calls those tools, but no unconsented lifecycle execution or exfiltration path was found.

Mechanism

User-invoked agent tools for messaging, web fetch, shell, files, and integrations.

Rationale

Static inspection shows a broad plugin-based agent framework with dangerous but package-aligned, user-invoked capabilities and no install-time/import-time malware, credential harvesting loop, persistence payload, or hardcoded exfiltration endpoint. Scanner findings are explained by integrations and protocol code rather than concrete malicious behavior.

Evidence

package.jsonbin/freddie.jssrc/index.jssrc/host/host.jssrc/host/index.jsplugins/homeassistant_tool/handler.jsplugins/send_message/handler.jsplugins/platform-wecom_crypto/handler.jsplugins/env_passthrough/handler.jsplugins/web_tools/handler.js

Network endpoints4

homeassistant.local:8123raw.githubusercontent.com/AnEntrypoint/freddie-skills/main/index.jsonapi.spotify.com/v1openrouter.ai/api/v1/chat/completions

Decision evidence

public snapshot

AI called this Clean at 86.0% confidence as Benign with low false-positive risk.

Evidence for block

Agent package includes user-invoked shell/file/network tools such as plugins/bash, plugins/write, plugins/web_tools.

Evidence against

package.json has no install/preinstall/postinstall/prepare lifecycle hooks.
bin/freddie.js only boots plugin host and registers CLI commands when invoked.
src/index.js is export-only and has no import-time payload behavior.
plugins/homeassistant_tool/handler.js sends HASS_TOKEN only to configured HASS_URL or local Home Assistant API during tool use.
plugins/send_message/handler.js dynamic import is limited to a fixed platform map, not attacker-controlled arbitrary paths.
plugins/platform-wecom_crypto/handler.js uses SHA1/AES-CBC for WeCom protocol verification/decryption, not credential theft.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

Manifest

GitDependencyWildcardDependency

scanned 422 file(s), 533 KB of source, external domains: 127.0.0.1, api.byterover.com, api.hindsightai.com, api.honcho.dev, api.hunyuan.cloud.tencent.com, api.mem0.ai, api.moonshot.ai, api.moonshot.cn, api.nousresearch.com, api.openviking.com, api.osv.dev, api.retaindb.com, api.sgroup.qq.com, api.spotify.com, api.supermemory.ai, api.telegram.org, api.twilio.com, api.vercel.com, api.weixin.qq.com, api.x.ai, api.z.ai, app.daytona.io, cloudcode-pa.googleapis.com, discord.com, graph.facebook.com, homeassistant.local, html.duckduckgo.com, models.dev, oapi.dingtalk.com, oauth2.googleapis.com, open.bigmodel.cn, open.feishu.cn, openrouter.ai, qyapi.weixin.qq.com, raw.githubusercontent.com, serpapi.com, slack.com, www.apple.com, www.googleapis.com

Source & flagged code

3 flagged

plugins/send_message/handler.jsView file

Lines 1-31javascript

1const PLATFORM_MODULES = {

2 telegram: '../gateway/platforms/telegram.js',

3 discord: '../gateway/platforms/discord.js',

4 slack: '../gateway/platforms/slack.js',

5 whatsapp: '../gateway/platforms/whatsapp.js',

6 email: '../gateway/platforms/email.js',

7 sms: '../gateway/platforms/sms.js',

8 matrix: '../gateway/platforms/matrix.js',

9 signal: '../gateway/platforms/signal.js',

10 mattermost: '../gateway/platforms/mattermost.js',

11}

13export const _tool = ({

14 name: 'send_message',

15 toolset: 'core',

16 schema: { name: 'send_message', description: 'Send a message to a recipient on the named platform. Uses the gateway adapter; requires the platform credentials.', parameters: { type: 'object', properties: { platform: { type: 'string', enum: Object.keys(PLATFORM_MODULES) }, to: { type: 'string' }, text: { type: 'string' } }, required: ['platform', 'to', 'text'] } },

17 handler: async ({ platform, to, text }) => {

18 const mod = PLATFORM_MODULES[platform]

19 if (!mod) return { error: 'unknown platform: ' + platform }

20 const m = await import(mod)

21 const cls = Object.values(m)[0]

Medium

Dynamic Require

Package source references dynamic require/import behavior.

plugins/send_message/handler.jsView on unpkg · L19

22 const inst = new cls({})

23 try { await inst.start() } catch (e) { return { error: String(e.message || e) } }

24 try {

25 const out = await inst.send({ to, text })

26 await inst.stop?.()

27 return { ok: true, response: out }

28 } catch (e) { await inst.stop?.(); return { error: String(e.message || e) } }

29 },

30})

plugins/platform-wecom_crypto/handler.jsView file

Lines 1-17javascript

1import crypto from 'node:crypto'

2export function sha1(...parts) { return crypto.createHash('sha1').update(parts.sort().join('')).digest('hex') }

3export function

plugins/homeassistant_tool/handler.jsView file

Lines 1-15javascript

1export const _tool = ({

2 name: 'homeassistant_tool',

3 toolset: 'core',

4 schema: { name: 'homeassistant_tool', description: 'Read state or call a service on Home Assistant.', parameters: { type: 'object', properties: { action: { type: 'string', enum: ['state', 'service'] }, entity_id: { type: 'string' }, domain: { type: 'string' }, service: { type:

Source & flagged code

3 flagged · loading source

plugins/send_message/handler.jsView file

19if (!mod) return { error: 'unknown platform: ' + platform } L20: const m = await import(mod) L21: const cls = Object.values(m)[0]

Medium

Dynamic Require

Package source references dynamic require/import behavior.

plugins/send_message/handler.jsView on unpkg · L19

plugins/platform-wecom_crypto/handler.jsView file

6export function decryptMsg(encryptedB64, encodingAesKey) { L7: const aesKey = Buffer.from(encodingAesKey + '=', 'base64') L8: const iv = aesKey.slice(0, 16)

Low

Weak Crypto

Package source references weak cryptographic algorithms.

plugins/platform-wecom_crypto/handler.jsView on unpkg · L6

plugins/homeassistant_tool/handler.jsView file

3toolset: 'core', L4: schema: { name: 'homeassistant_tool', description: 'Read state or call a service on Home Assistant.', parameters: { type: 'object', properties: { action: { type: 'string', enum: ['... L5: requiresEnv: ['HASS_TOKEN', 'HASS_URL'], L6: checkFn: () => Boolean(process.env.HASS_TOKEN), L7: handler: async ({ action, entity_id, domain, service, data = {} }) => { L8: const url = process.env.HASS_URL || 'http://homeassistant.local:8123' L9: const auth = { authorization: `Bearer ${process.env.HASS_TOKEN}` } L10: if (action === 'state') return await (await fetch(`${url}/api/states/${entity_id}`, { headers: auth })).json() L11: if (action === 'service') return await (await fetch(`${url}/api/services/${domain}/${service}`, { method: 'POST', headers: { ...auth, 'content-type': 'application/json' }, body: JS...

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

plugins/homeassistant_tool/handler.jsView on unpkg · L3

Findings

1 Critical5 Medium5 Low

CriticalCredential Exfiltrationplugins/homeassistant_tool/handler.js

MediumDynamic Requireplugins/send_message/handler.js

MediumNetwork

MediumEnvironment Vars

MediumGit Dependency

MediumWildcard Dependency

LowScripts Present

LowWeak Cryptoplugins/platform-wecom_crypto/handler.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

plugins/send_message/handler.jsView file

Lines 1-31javascript

1const PLATFORM_MODULES = {

2 telegram: '../gateway/platforms/telegram.js',

3 discord: '../gateway/platforms/discord.js',

4 slack: '../gateway/platforms/slack.js',

5 whatsapp: '../gateway/platforms/whatsapp.js',

6 email: '../gateway/platforms/email.js',

7 sms: '../gateway/platforms/sms.js',

8 matrix: '../gateway/platforms/matrix.js',

9 signal: '../gateway/platforms/signal.js',

10 mattermost: '../gateway/platforms/mattermost.js',

11}

13export const _tool = ({

14 name: 'send_message',

15 toolset: 'core',

17 handler: async ({ platform, to, text }) => {

18 const mod = PLATFORM_MODULES[platform]

19 if (!mod) return { error: 'unknown platform: ' + platform }

20 const m = await import(mod)

21 const cls = Object.values(m)[0]

Medium

Dynamic Require

Package source references dynamic require/import behavior.

plugins/send_message/handler.jsView on unpkg · L19

22 const inst = new cls({})

23 try { await inst.start() } catch (e) { return { error: String(e.message || e) } }

24 try {

25 const out = await inst.send({ to, text })

26 await inst.stop?.()

27 return { ok: true, response: out }

28 } catch (e) { await inst.stop?.(); return { error: String(e.message || e) } }

29 },

30})

plugins/platform-wecom_crypto/handler.jsView file

Lines 1-17javascript

1import crypto from 'node:crypto'

2export function sha1(...parts) { return crypto.createHash('sha1').update(parts.sort().join('')).digest('hex') }

3export function

plugins/homeassistant_tool/handler.jsView file

Lines 1-15javascript

1export const _tool = ({

2 name: 'homeassistant_tool',

3 toolset: 'core',