ft-scout@9.4.8
FrontTerrain — The Onboarding Co-Pilot for New Codebases
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe package’s telemetry path can transmit user task prompts to its own service when a session ID is present, without a clear disclosure of prompt collection or a visible opt-out. The path is conditional on persisted QR pairing state, so the evidence supports a warning rather than a high-confidence malicious block.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
An agent execution writes telemetry while ~/.ft/scout_telemetry.json contains a sessionId from the QR pairing flow.
Impact
The package service may receive user prompts and project identifiers beyond the agent’s ordinary model request. The flow is conditional on persisted pairing state, and the source does not expose an opt-out.
Mechanism
Agent telemetry records the current task and project basename; writeTelemetry forwards the updated record to Firestore for that session.
AI rationale
The package’s telemetry path can transmit user task prompts to its own service when a session ID is present, without a clear disclosure of prompt collection or a visible opt-out. The path is conditional on persisted QR pairing state, so the evidence supports a warning rather than a high-confidence malicious block.
Evidence
bin/src/engine/agentEngine.jsbin/src/utils/qrBridge.js~/.ft/scout_telemetry.json
Network endpoints1
firestore.googleapis.com
Decision evidence
public snapshotAI called this Suspicious at 79.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- Agent telemetry includes the current task prompt and project basename.
- When a telemetry session ID exists, local telemetry is sent to the package’s Firestore project.
- The QR pairing flow seeds a telemetry session and tells users that telemetry is streaming, but does not explain that task prompts are included or provide an opt-out.
Evidence against
- The manifest has no install or postinstall hook; its CLI entry starts the command interface.
- Email dispatch is part of explicit signup and uses configured email providers or Firebase for verification.
- LLM API keys are routed to their configured provider endpoints.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
19 flaggedbin/src/utils/firebaseAuth.jsView file
1patternName = google_api_key
severity = high
line = 1
High
High Secret
Package contains a high-severity secret pattern.
bin/src/utils/firebaseAuth.jsView on unpkg · L11patternName = google_api_key
severity = high
line = 1
High
Secret Pattern
Google API key in bin/src/utils/firebaseAuth.js
bin/src/utils/firebaseAuth.jsView on unpkg · L1bin/src/server/server.jsView file
3import path from 'path';
L4: import { exec } from 'child_process';
L5: import { fileURLToPath } from 'url';
High
Child Process
Package source references child process execution.
bin/src/server/server.jsView on unpkg · L3Findings
4 Critical12 High5 Medium5 Low
CriticalHardcoded Runtime Data Exfiltrationbin/src/utils/qrBridge.js
CriticalCredential Exfiltrationbin/src/utils/email.js
CriticalTrigger Reachable Dangerous Capabilitybin/src/utils/qrBridge.js
CriticalPrevious Version Dangerous Deltabin/src/engine/voiceEngine.js
HighHigh Secretbin/src/utils/firebaseAuth.js
HighChild Processbin/src/server/server.js
HighShellbin/src/commands/watch.js
HighSame File Env Network Executionbin/src/utils/holoseneAuth.js
HighSandbox Evasion Gated Capabilitybin/src/commands/setup.js
HighRemote Agent Bridgebin/src/engine/agentEngine.js
HighTrigger Reachable Credential Exfiltration
Affected versions and remediation
This report applies to ft-scout@9.4.8.
See all versions of ft-scout for other recorded verdicts.
- Review the evidence and your use of ft-scout@9.4.8 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.