registry / freddie / 0.0.123

freddie@0.0.123

Open JS agent harness built on pi-mono, floosie, xstate, and anentrypoint-design

AI Security Review

scanned 13d ago · by lpm-firewall-ai

No confirmed malicious attack surface was established by source inspection. Risky primitives are explicit agent features gated by CLI/tool invocation or user configuration, not install-time or import-time behavior.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

User runs freddie CLI/dashboard or an agent invokes configured tools.

Impact

No unconsented credential harvesting, persistence, destructive action, or hidden exfiltration identified.

Mechanism

plugin-based AI agent harness with user-invoked tools and provider integrations

Rationale

Static inspection shows a legitimate plugin-driven AI agent CLI with explicit shell, network, credential, and messaging capabilities, but no lifecycle execution or covert credential exfiltration. Scanner-critical Home Assistant finding is a false positive because the token is used as authorization to the configured Home Assistant endpoint during explicit tool execution.

Evidence

package.jsonbin/freddie.jssrc/host/index.jssrc/host/host.jssrc/auth.jsplugins/homeassistant_tool/handler.jsplugins/platform-wecom_crypto/handler.jsplugins/send_message/handler.jsplugins/bash/handler.jsplugins/code_execution/handler.js~/.freddie/auth/*.json<FREDDIE_HOME>/trajectories/*.json

Decision evidence

public snapshot

AI called this Clean at 84.0% confidence as Benign with low false-positive risk.

Evidence for block

User-invoked agent tools include shell/code execution in plugins/bash/handler.js and plugins/code_execution/handler.js.
Plugin discovery can load local user plugins from FREDDIE_HOME or cwd .freddie paths in src/host/index.js.

Evidence against

package.json has no install/preinstall/postinstall lifecycle scripts; bin only boots CLI plugins.
plugins/homeassistant_tool/handler.js sends HASS_TOKEN only to configured HASS_URL/Home Assistant API for explicit tool calls.
plugins/platform-wecom_crypto/handler.js implements WeCom signature/decrypt helpers; SHA1 is protocol-aligned, not payload logic.
plugins/send_message/handler.js imports only a fixed allowlist of platform adapters, not arbitrary user-controlled modules.
src/auth.js stores credentials locally under Freddie home with mode 0600; gui-auth masks values on read.
LLM/network calls are package-aligned agent, dashboard, messaging, memory, and provider integrations; no hidden import-time exfiltration found.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

Manifest

GitDependencyWildcardDependency

scanned 422 file(s), 533 KB of source, external domains: 127.0.0.1, api.byterover.com, api.hindsightai.com, api.honcho.dev, api.hunyuan.cloud.tencent.com, api.mem0.ai, api.moonshot.ai, api.moonshot.cn, api.nousresearch.com, api.openviking.com, api.osv.dev, api.retaindb.com, api.sgroup.qq.com, api.spotify.com, api.supermemory.ai, api.telegram.org, api.twilio.com, api.vercel.com, api.weixin.qq.com, api.x.ai, api.z.ai, app.daytona.io, cloudcode-pa.googleapis.com, discord.com, graph.facebook.com, homeassistant.local, html.duckduckgo.com, models.dev, oapi.dingtalk.com, oauth2.googleapis.com, open.bigmodel.cn, open.feishu.cn, openrouter.ai, qyapi.weixin.qq.com, raw.githubusercontent.com, serpapi.com, slack.com, www.apple.com, www.googleapis.com

Source & flagged code

3 flagged

plugins/send_message/handler.jsView file

Lines 1-31javascript

1const PLATFORM_MODULES = {

2 telegram: '../gateway/platforms/telegram.js',

3 discord: '../gateway/platforms/discord.js',

4 slack: '../gateway/platforms/slack.js',

5 whatsapp: '../gateway/platforms/whatsapp.js',

6 email: '../gateway/platforms/email.js',

7 sms: '../gateway/platforms/sms.js',

8 matrix: '../gateway/platforms/matrix.js',

9 signal: '../gateway/platforms/signal.js',

10 mattermost: '../gateway/platforms/mattermost.js',

11}

13export const _tool = ({

14 name: 'send_message',

15 toolset: 'core',

16 schema: { name: 'send_message', description: 'Send a message to a recipient on the named platform. Uses the gateway adapter; requires the platform credentials.', parameters: { type: 'object', properties: { platform: { type: 'string', enum: Object.keys(PLATFORM_MODULES) }, to: { type: 'string' }, text: { type: 'string' } }, required: ['platform', 'to', 'text'] } },

17 handler: async ({ platform, to, text }) => {

18 const mod = PLATFORM_MODULES[platform]

19 if (!mod) return { error: 'unknown platform: ' + platform }

20 const m = await import(mod)

21 const cls = Object.values(m)[0]

Medium

Dynamic Require

Package source references dynamic require/import behavior.

plugins/send_message/handler.jsView on unpkg · L19

22 const inst = new cls({})

23 try { await inst.start() } catch (e) { return { error: String(e.message || e) } }

24 try {

25 const out = await inst.send({ to, text })

26 await inst.stop?.()

27 return { ok: true, response: out }

28 } catch (e) { await inst.stop?.(); return { error: String(e.message || e) } }

29 },

30})

plugins/platform-wecom_crypto/handler.jsView file

Lines 1-17javascript

1import crypto from 'node:crypto'

2export function sha1(...parts) { return crypto.createHash('sha1').update(parts.sort().join('')).digest('hex') }

3export function

plugins/homeassistant_tool/handler.jsView file

Lines 1-15javascript

1export const _tool = ({

2 name: 'homeassistant_tool',

3 toolset: 'core',

4 schema: { name: 'homeassistant_tool', description: 'Read state or call a service on Home Assistant.', parameters: { type: 'object', properties: { action: { type: 'string', enum: ['state', 'service'] }, entity_id: { type: 'string' }, domain: { type: 'string' }, service: { type:

Source & flagged code

3 flagged · loading source

plugins/send_message/handler.jsView file

19if (!mod) return { error: 'unknown platform: ' + platform } L20: const m = await import(mod) L21: const cls = Object.values(m)[0]

Medium

Dynamic Require

Package source references dynamic require/import behavior.

plugins/send_message/handler.jsView on unpkg · L19

plugins/platform-wecom_crypto/handler.jsView file

6export function decryptMsg(encryptedB64, encodingAesKey) { L7: const aesKey = Buffer.from(encodingAesKey + '=', 'base64') L8: const iv = aesKey.slice(0, 16)

Low

Weak Crypto

Package source references weak cryptographic algorithms.

plugins/platform-wecom_crypto/handler.jsView on unpkg · L6

plugins/homeassistant_tool/handler.jsView file

3toolset: 'core', L4: schema: { name: 'homeassistant_tool', description: 'Read state or call a service on Home Assistant.', parameters: { type: 'object', properties: { action: { type: 'string', enum: ['... L5: requiresEnv: ['HASS_TOKEN', 'HASS_URL'], L6: checkFn: () => Boolean(process.env.HASS_TOKEN), L7: handler: async ({ action, entity_id, domain, service, data = {} }) => { L8: const url = process.env.HASS_URL || 'http://homeassistant.local:8123' L9: const auth = { authorization: `Bearer ${process.env.HASS_TOKEN}` } L10: if (action === 'state') return await (await fetch(`${url}/api/states/${entity_id}`, { headers: auth })).json() L11: if (action === 'service') return await (await fetch(`${url}/api/services/${domain}/${service}`, { method: 'POST', headers: { ...auth, 'content-type': 'application/json' }, body: JS...

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

plugins/homeassistant_tool/handler.jsView on unpkg · L3

Findings

1 Critical5 Medium5 Low

CriticalCredential Exfiltrationplugins/homeassistant_tool/handler.js

MediumDynamic Requireplugins/send_message/handler.js

MediumNetwork

MediumEnvironment Vars

MediumGit Dependency

MediumWildcard Dependency

LowScripts Present

LowWeak Cryptoplugins/platform-wecom_crypto/handler.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

plugins/send_message/handler.jsView file

Lines 1-31javascript

1const PLATFORM_MODULES = {

2 telegram: '../gateway/platforms/telegram.js',

3 discord: '../gateway/platforms/discord.js',

4 slack: '../gateway/platforms/slack.js',

5 whatsapp: '../gateway/platforms/whatsapp.js',

6 email: '../gateway/platforms/email.js',

7 sms: '../gateway/platforms/sms.js',

8 matrix: '../gateway/platforms/matrix.js',

9 signal: '../gateway/platforms/signal.js',

10 mattermost: '../gateway/platforms/mattermost.js',

11}

13export const _tool = ({

14 name: 'send_message',

15 toolset: 'core',

17 handler: async ({ platform, to, text }) => {

18 const mod = PLATFORM_MODULES[platform]

19 if (!mod) return { error: 'unknown platform: ' + platform }

20 const m = await import(mod)

21 const cls = Object.values(m)[0]

Medium

Dynamic Require

Package source references dynamic require/import behavior.

plugins/send_message/handler.jsView on unpkg · L19

22 const inst = new cls({})

23 try { await inst.start() } catch (e) { return { error: String(e.message || e) } }

24 try {

25 const out = await inst.send({ to, text })

26 await inst.stop?.()

27 return { ok: true, response: out }

28 } catch (e) { await inst.stop?.(); return { error: String(e.message || e) } }

29 },

30})

plugins/platform-wecom_crypto/handler.jsView file

Lines 1-17javascript

1import crypto from 'node:crypto'

2export function sha1(...parts) { return crypto.createHash('sha1').update(parts.sort().join('')).digest('hex') }

3export function

plugins/homeassistant_tool/handler.jsView file

Lines 1-15javascript

1export const _tool = ({

2 name: 'homeassistant_tool',

3 toolset: 'core',