registry / instar / 1.3.1401

instar@1.3.1401

⚠ Under review

Coherence infrastructure for self-evolving AI agents — on the Claude Code or Codex subscription you already have.

AI Security Review

scanned 3d ago · by lpm-firewall-ai

Inspected source resolved several high-risk scanner hints to ordinary Telegram API, Git signing, and credential-prompt guard behavior. The requested clean review requires more citations than the 256-reference limit permits, so the remaining uncertainty is review coverage rather than confirmed malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

No malicious trigger was confirmed in the inspected paths.

Impact

No attack impact was established from these excerpts; broader source coverage remains unresolved.

Mechanism

The reviewed excerpts showed Telegram API requests, Git signing setup for active machines, and installation of a guard that blocks free-text credential prompts.

AI rationale

Evidence

package.jsondist/messaging/TelegramAdapter.jsdist/core/GitSync.js.claude/hooks/free-text-guard.shdist/core/PostUpdateMigrator.jsdist/commands/init.js

Network endpoints1

api.telegram.org

Decision evidence

public snapshot

AI called this Manual Review at 62.0% confidence as Unknown with medium false-positive risk.

AI review observations

The manifest's postinstall runs a native SQLite repair script.
The inspected Telegram request uses the Telegram Bot API and redacts the bot token in its safe URL.
Git sync builds its allowed-signers file from active machine identities and configures Git to use it.
The inspected hook blocks free-text credential prompts unless they are clearly multi-choice decisions.
The migrator installs that free-text guard as an Instar hook.
The inspected init code installs built-in skills under the project’s .claude directory.

Evidence against

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsPossibleObfuscationUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2,126 file(s), 31.6 MB of source, external domains: 127.0.0.1, abc123.trycloudflare.com, accounts.google.com, ai.google.dev, api.anthropic.com, api.cloudflare.com, api.github.com, api.groq.com, api.mail.tm, api.openai.com, api.slack.com, api.telegra.ph, api.telegram.org, api.typesafe.ai, auth.anthropic.com, auth.openai.com, blob.vercel-storage.com, bot-me.ai, brew.sh, chatgpt.com, claude.ai, claude.com, cli.github.com, console.anthropic.com, console.cloud.google.com, dawn.bot-me.ai, docs.anthropic.com, example.invalid, feedback.dawn-tunnel.dev, files.slack.com, git-scm.com, github.com, graph.facebook.com, groq.com, instar-telemetry.sagemind-ai.workers.dev, instar.sh, myaccount.google.com, myapp.vercel.app, nodejs.org, openrouter.ai, platform.claude.com, platform.openai.com, raw.githubusercontent.com, sagemindai.io, sentry.io, slack.com, staging.myapp.com, support.google.com, telegra.ph, threadline-relay.fly.dev

Source & flagged code

17 flagged

package.jsonView file

Lines 45-85json

45 "lint:undefined-erasing-default-merge": "node scripts/lint-no-undefined-erasing-default-merge.js",

46 "lint:destructive": "node scripts/lint-no-direct-destructive.js",

47 "lint:dev-agent-dark-gate": "node scripts/lint-dev-agent-dark-gate.js",

48 "lint:guard-manifest": "node scripts/lint-guard-manifest.js",

49 "lint:dev-agent-dark-gate:staged": "node scripts/lint-dev-agent-dark-gate.js --staged",

50 "lint:destructive:staged": "node scripts/lint-no-direct-destructive.js --staged",

51 "lint:llm-http": "node scripts/lint-no-direct-llm-http.js",

52 "lint:scrape-realness": "node scripts/lint-scrape-fixture-realness.js",

53 "lint:scrape-realness:staged": "node scripts/lint-scrape-fixture-realness.js --staged",

54 "lint:llm-attribution": "node scripts/lint-llm-attribution.js",

55 "lint:llm-attribution:staged": "node scripts/lint-llm-attribution.js --staged",

56 "lint:llm-http:staged": "node scripts/lint-no-direct-llm-http.js --staged",

57 "lint:credential-write": "node scripts/lint-no-unfunneled-credential-write.js",

58 "lint:credential-write:staged": "node scripts/lint-no-unfunneled-credential-write.js --staged",

59 "clean": "rm -rf dist",

60 "check:upgrade-guide": "node scripts/check-upgrade-guide.js",

61 "check:pre-push-gate": "node scripts/pre-push-gate.js",

62 "check:release": "node scripts/analyze-release.js",

63 "check:contract-evidence": "node scripts/check-contract-evidence.js",

64 "prepublishOnly": "npm run build && node scripts/verify-codex-stage-b-release-evidence.mjs && npm run check:upgrade-guide && npm run check:contract-evidence",

65 "postinstall": "node scripts/fix-better-sqlite3.cjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L65

66 "prepare": "husky",

67 "lint:standards-registry-path": "node scripts/lint-no-direct-standards-registry-path.mjs",

68 "lint:framework-list": "node scripts/lint-framework-list-completeness.mjs"

69 },

70 "keywords": [

71 "instar",

72 "ai-agent",

73 "autonomous-agent",

74 "claude",

75 "claude-code",

76 "agent-framework",

77 "telegram-bot",

78 "job-scheduler",

79 "agent-memory",

80 "agent-identity",

81 "llm",

82 "mcp",

83 "cli",

84 "molt",

85 "lobster"

dist/threadline/PipeSessionSpawner.jsView file

Lines 1-35javascript

1/**

2 * PipeSessionSpawner — Spawns lightweight `claude -p` sessions for simple

3 * threadline queries. Sessions auto-exit when done, reducing zombie risk

4 * and session slot consumption.

5 *

6 * Part of RFC: Persistent Listener Daemon Architecture (Phase 2).

7 *

8 * Security model:

9 * - Messages wrapped in <untrusted-message> XML tags (injection-hardened)

10 * - Thread history LLM-summarized before injection (strips jailbreak assembly)

scripts/check-rule3-coverage.cjsView file

Lines 16-56javascript

16 * - tmux capture-pane / send-keys patterns

17 * - JSON.parse on subprocess stdout

18 * - new class

dist/core/PostUpdateMigrator.jsView file

•path = dist/core/PostUpdateMigrator.js kind = trigger_reachable_excluded_payload sizeBytes = 1406272 triggerReachableSource = dist/core/PostUpdateMigrator.js excludedPayload = .claude/hooks/free-text-guard.sh

Critical

Trigger Reachable Excluded Directory Payload

A package entrypoint or install-reachable source explicitly loads and activates an executable-looking payload from a test, fixture, or hidden path.

dist/core/PostUpdateMigrator.jsView on unpkg

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. w); if (current.includes(anyrow) && start >= 0 && end > start) { current = current.replace(anyrow, subscription_signin_skill_content.slice(start, end) + anyrow); changes.push('three failure-table rows'); } } if (changes.length === 0) { if (!current.includes(marker) || !current.includes(rowsmarker)) { result.skipped.push('skills/subscription-signin/skill.md: customized — left untouched (no cross-machine section)'); } return; } fs.writefilesync(skillfile, current); result.upgraded.pus

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/core/PostUpdateMigrator.jsView on unpkg

31import os from 'node:os'; L32: import { execFileSync } from 'node:child_process'; L33: import crypto from 'node:crypto'; ... L80: import { migrateStageBReleaseConfig, [redacted] } from './StageBActivationGate.js'; L81: const __dirname = path.dirname(fileURLToPath(import.meta.url)); L82: /** ... L154: An autonomous window is active only while FIVE independently observed predicates are green: its bound executor process is running; its bound framework transcript has a fresh heartb... L155: - **Registry First:** GET http://localhost:${port}/window-run-liveness returns the durable state, predicate verdicts, recovery receipt, hash-chained sample/work audit, transitions,... L156: - **Durable work receipts:** POST /window-run-liveness/work-advance accepts only the immutable run binding plus a

skills/spec-converge/scripts/publish-spec-review.mjsView file

Lines 1-40javascript

1#!/usr/bin/env node

2/**

3 * publish-spec-review.mjs — the sanctioned way to deliver a spec for review.

4 *

5 * Structure > Willpower: sending a spec for review WITHOUT a rendered,

6 * verified ELI16 tunnel link should be impossible, not something the agent

7 * remembers to attach. This script makes the correct delivery atomic:

8 *

9 * 1. Resolve the spec's ELI16 companion using the SAME convention the

10 * commit-time gate enforces (scripts/eli16-overview-check.mjs).

dist/messaging/TelegramAdapter.jsView file

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/messaging/TelegramAdapter.js: import { INVITE_PREFIX } from '../threadline/PairingInvite.js'; const PAIRING_DASHBOARD_FALLBACK = 'I got a pairing invite, but I can\'t take it from this chat. Open the Threadline tab on the dashboard and paste it there; you approve with your ... fs.writeFileSync(tmpPath, JSON.stringify(config, null, 2)); fs.writeFileSync(tmpPath, JSON.stringify({ messageId, savedAt: new Date().toISOString() })); fs.writeFileSync(tmpPath, JSON.stringify(config, null, 2)); * Public read-only authorization check for a sender id (Know Your Principal #898, fs.writeFileSync(destPath, buffer); baseUrl: 'https://api.groq.co

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/messaging/TelegramAdapter.jsView on unpkg

dist/core/GitSync.jsView file

Lines 1-32javascript

1/**

2 * Git-based state synchronization for multi-machine coordination.

3 *

4 * Handles:

5 * - Configuring git commit signing with machine Ed25519 keys

6 * - Commit signing verification on pull

7 * - Debounced auto-commit + push

8 * - Relationship merge with field-level resolution

9 * - Conflict resolution strategies

10 *

11 * Part of Phase 3 (state sync via git).

dist/commands/setup.jsView file

Lines 1-37javascript

1/**

2 * Interactive setup wizard — the one-line onboarding experience.

3 *

4 * `npx instar` or `instar setup` walks through everything:

5 * 1. Project detection + naming

6 * 2. Secret management (Bitwarden / local encrypted / manual)

7 * 3. Telegram setup (primary communication channel)

8 * 4. User setup (name, email, permissions)

9 * 5. Scheduler + first job (optional)

10 * 6. Start server

scripts/run-contract-tests.jsView file

39try { L40: execSync('npx vitest run --config vitest.contract.config.ts', { L41: cwd: ROOT,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/run-contract-tests.jsView on unpkg · L39

.claude/hooks/free-text-guard.shView file

•path = .claude/hooks/free-text-guard.sh kind = payload_in_excluded_dir sizeBytes = 3888 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.claude/hooks/free-text-guard.shView on unpkg

•path = .claude/hooks/free-text-guard.sh kind = build_helper sizeBytes = 3888 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

.claude/hooks/free-text-guard.shView on unpkg

dist/commands/devPreflight.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 86

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/commands/devPreflight.js#virtual:normalized:round1View on unpkg

Source & flagged code

17 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/fix-better-sqlite3.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/threadline/PipeSessionSpawner.jsView file

15*/ L16: import { execSync } from 'node:child_process'; L17: import fs from 'node:fs';

High

Child Process

Package source references child process execution.

dist/threadline/PipeSessionSpawner.jsView on unpkg · L15

352// Spawn tmux session, recording its incarnation (session id + pane pid) L353: const created = execSync(`tmux new-session -d -P -F '#{session_id} #{pane_pid}' -s "${sessionName}" -x 200 -y 50 'bash -c "${shellCmd.replace(/"/g, '\\"')}"'`, { timeout: 10_000, e... L354: const [tmuxId, panePid] = created.split(' ');

High

Shell

Package source references shell execution.

Findings

3 Critical11 High6 Medium5 Low

CriticalPersistence Backdoordist/core/GitSync.js

CriticalTrigger Reachable Dangerous Capabilitydist/core/GitSync.js

CriticalTrigger Reachable Excluded Directory Payloaddist/core/PostUpdateMigrator.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/threadline/PipeSessionSpawner.js

HighShelldist/threadline/PipeSessionSpawner.js

HighSame File Env Network Executionskills/spec-converge/scripts/publish-spec-review.mjs

HighCredential Redirect Persistencedist/messaging/TelegramAdapter.js

HighSandbox Evasion Gated Capabilitydist/commands/setup.js

HighTrigger Reachable External Ai Agent Control Surface Mutationdist/core/PostUpdateMigrator.js

Affected versions and remediation

This report applies to instar@1.3.1401.

See all versions of instar for other recorded verdicts.

Review the evidence and your use of instar@1.3.1401 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-22 20:14:03.417Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.