registry / maestro-flow / 0.5.45

maestro-flow@0.5.45

Intent-driven workflow orchestration for multi-agent AI development with adaptive lifecycle engine and self-reinforcing knowledge graph

AI Security Review

scanned 4d ago · by lpm-firewall-ai

No confirmed malicious attack surface was established. The risky primitives are CLI/dashboard orchestration features: spawning local tools, opening a browser, stopping local dashboard processes, and registering MCP/config entries when the user invokes those commands.

Static reason

One or more suspicious static signals were detected.

Trigger

User runs maestro CLI commands such as maestro view, maestro stop, maestro install, or dashboard MCP management APIs.

Impact

Legitimate local workflow setup; no install-time execution, credential theft, persistence, or external exfiltration confirmed.

Mechanism

user-invoked local orchestration and config mutation

Rationale

Static inspection shows a workflow orchestration CLI with explicit user-invoked local process management and agent config installation, but no lifecycle execution, hidden payload, credential harvesting, or external exfiltration. The scanner findings are package-aligned capabilities rather than concrete attack behavior.

Evidence

package.jsonbin/maestro.jsdist/src/commands/view.jsdist/src/commands/stop.jsdist/src/commands/install.jsdist/src/commands/install-backend.jsdashboard/dist-server/dashboard/src/server/routes/mcp.js.agents/skills/team-adversarial-swarm/scripts/test_aco.pydist/src/migrations/_template.jsdist/src/index.js~/.claude.json~/.codex/config.toml<project>/.mcp.json<project>/.codex/config.toml

Network endpoints3

127.0.0.1:<port>/api/health127.0.0.1:<port>/api/shutdown<host>:<port>/api/workspace

Decision evidence

public snapshot

AI called this Clean at 86.0% confidence as Benign with medium false-positive risk.

Evidence for block

Contains user-invoked child_process use in bin/maestro.js and dist/src/commands/view.js.
User-invoked install/MCP flows write Claude/Codex config files in dist/src/commands/install-backend.js and dashboard route code.

Evidence against

package.json has no install/postinstall/preinstall hook; prepublishOnly is publisher-side build only.
bin/maestro.js only relaunches its own CLI with WASM flags before importing dist/src/cli.js.
dist/src/commands/view.js and stop.js target local dashboard operations on localhost/127.0.0.1.
MCP/config writes are explicit maestro install or dashboard API actions aligned with package purpose.
No credential harvesting or external exfiltration endpoint found in inspected sources.
Scanner payload file .agents/skills/team-adversarial-swarm/scripts/test_aco.py is a Python test harness, not an inert binary payload.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 955 file(s), 8.85 MB of source, external domains: 127.0.0.1, anthropic.com, api.anthropic.com, api.github.com, api.linear.app, chatgpt.com, docs.anthropic.com, docs.npmjs.com, fonts.googleapis.com, fonts.gstatic.com, github.com, impeccable.style, nodejs.org, radix-ui.com, react.dev, registry.npmjs.org, www.python.org, www.w3.org

Source & flagged code

11 flagged

bin/maestro.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import { spawnSync } from 'node:child_process';

3import { fileURLToPath } from 'node:url';

High

Child Process

Package source references child process execution.

bin/maestro.jsView on unpkg · L1

4import {

5 shouldApplyWasmFlags,

6 processHasWasmRuntimeFlags,

7 buildRelaunchArgv,

8 isNodeVersionWasmSensitive,

9} from '../dist/src/utils/wasm-relaunch.js';

11const WASM_RELAUNCH_GUARD = 'MAESTRO_WASM_RELAUNCHED';

12const SCRIPT_PATH = fileURLToPath(import.meta.url);

13const scriptArgs = process.argv.slice(2);

14const needsWasmFlags = shouldApplyWasmFlags(scriptArgs);

16if (

17 needsWasmFlags &&

18 !processHasWasmRuntimeFlags() &&

19 !process.env[WASM_RELAUNCH_GUARD] &&

20 !process.env.MAESTRO_NO_WASM_RELAUNCH

21) {

dist/src/commands/stop.jsView file

Lines 1-39javascript

1// ---------------------------------------------------------------------------

2// `maestro stop` — stop the running maestro dashboard server

3//

4// Strategy (3-stage):

5// 1. Try graceful shutdown via POST /api/shutdown

6// 2. Find process by port via netstat and kill it

7// 3. Force kill fallback (--force or when graceful fails)

8// ---------------------------------------------------------------------------

9import { exec } from 'node:child_process';

10// ---------------------------------------------------------------------------

dist/src/migrations/_template.jsView file

Lines 24-55javascript

24 // 1. Read current state

25 let state;

26 try {

27 state = JSON.parse(readFileSync(statePath, 'utf8'));

28 }

29 catch (e) {

30 return { success: false

dist/src/tools/core-memory.jsView file

Lines 11-51javascript

11import { join } from 'path';

12import { createHash } from 'crypto';

13import { homedir } from 'os';

14import { getProjectRoot } from '../utils/path-validator.js';

15// --- Zod Schema ---

16const OperationEnum

dist/src/commands/view.jsView file

Lines 161-216javascript

161 ...process.env,

162 PORT: String(port),

163 HOST: host,

164 WORKFLOW_ROOT: workflowRoot,

165 },

166 stdio: 'inherit',

167 });

168 tuiChild.on

dashboard/dist-server/dashboard/src/server/routes/mcp.jsView file

Lines 1-30javascript

1/**

2 * MCP Routes — Handles all MCP server management API endpoints.

3 *

4 * Ported from ccw's mcp-routes.ts, adapted to Hono framework.

5 * Manages MCP server configs across Claude (.claude.json, .mcp.json),

6 * Codex (config.toml), and enterprise managed-mcp.json.

7 */

8import { readFileSync, writeFileSync, existsSync, mkdirSync } from 'node:fs';

9import { join, dirname } from

dist/src/tools/impeccable/live/server.jsView file

Lines 1-21javascript

2// Licensed under the Apache License, Version 2.0

3// Modifications: Converted to TypeScript, adapted for maestro CLI architecture.

4/**

5 * Live variant mode server (self-contained, zero dependencies).

6 *

7 * Serves the browser script (/live.js), the detection overlay (/detect.js),

8 * uses Server-Sent Events (SSE) for server->browser push, and HTTP POST for

9 * browser->server events. Agent communicates via HTTP long-poll (/poll).

10 *

11 * Converted from live-server.mjs to TypeScript.

.agents/skills/team-adversarial-swarm/scripts/test_aco.pyView file

•path = .agents/skills/team-adversarial-swarm/scripts/test_aco.py kind = payload_in_excluded_dir sizeBytes = 18781 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.agents/skills/team-adversarial-swarm/scripts/test_aco.pyView on unpkg

•path = .agents/skills/team-adversarial-swarm/scripts/test_aco.py kind = build_helper sizeBytes = 18781 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

.agents/skills/team-adversarial-swarm/scripts/test_aco.pyView on unpkg

Source & flagged code

11 flagged · loading source

bin/maestro.jsView file

1#!/usr/bin/env node L2: import { spawnSync } from 'node:child_process'; L3: import { fileURLToPath } from 'node:url';

High

Child Process

Package source references child process execution.

bin/maestro.jsView on unpkg · L1

dist/src/commands/stop.jsView file

19// --------------------------------------------------------------------------- L20: function execAsync(cmd) { L21: return new Promise((resolve, reject) => {

High

Shell

Package source references shell execution.

dist/src/commands/stop.jsView on unpkg · L19

dist/src/migrations/_template.jsView file

44writeFileSync(tmpPath, JSON.stringify(state, null, 2), 'utf8'); L45: const { renameSync } = require('node:fs'); L46: renameSync(tmpPath, statePath);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/src/migrations/_template.jsView on unpkg · L44

dist/src/tools/core-memory.jsView file

31const hash = getProjectHash(projectPath); L32: return join(homedir(), '.maestro', 'data', 'core-memory', `${hash}.json`); L33: } ... L43: try { L44: return JSON.parse(readFileSync(storePath, 'utf-8')); L45: }

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/src/tools/core-memory.jsView on unpkg · L31

dist/src/commands/view.jsView file

181if (opts.browser) L182: openBrowser(`http://${browserHost}:${port}`); L183: console.error(''); ... L190: const env = { L191: ...process.env, L192: PORT: String(port), ... L196: // Spawn: concurrently runs Vite dev server + tsx backend L197: const child = spawn('npm', ['run', 'dev'], { L198: cwd: dashboardDir,

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/src/commands/view.jsView on unpkg · L181

196// Spawn: concurrently runs Vite dev server + tsx backend L197: const child = spawn('npm', ['run', 'dev'], { L198: cwd: dashboardDir, ... L203: }); L204: // Parse Vite's actual port from output (e.g. "Local: http://localhost:5174/") L205: let vitePort = null; ... L208: const text = d.toString(); L209: process.stderr.write(d); L210: if (!vitePort) {

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/src/commands/view.jsView on unpkg · L196

116console.error(` Starting dashboard server on port ${port}...`); L117: const child = spawn('npx', ['tsx', tsEntry], { L118: cwd: dashboardDir,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/src/commands/view.jsView on unpkg · L116

dashboard/dist-server/dashboard/src/server/routes/mcp.jsView file

10import { homedir } from 'node:os'; L11: import { execSync } from 'node:child_process'; L12: import { Hono } from 'hono'; ... L16: // --------------------------------------------------------------------------- L17: const CLAUDE_CONFIG_PATH = join(homedir(), '.claude.json'); L18: /** ... L27: // XDG fallback (Linux) L28: const xdg = process.env.XDG_CONFIG_HOME; L29: if (xdg) { ... L208: return null; L209: return JSON.parse(readFileSync(filePath, 'utf-8')); L210: }

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dashboard/dist-server/dashboard/src/server/routes/mcp.jsView on unpkg · L10

dist/src/tools/impeccable/live/server.jsView file

1Cross-file remote execution chain: [redacted].js spawns [redacted]-browser.js; helper contains network access plus dynamic code execution. L1: // Copyright 2024 Paul Bakaus (https://github.com/pbakaus/impeccable) L2: // Licensed under the Apache License, Version 2.0 ... L14: import { randomUUID } from 'node:crypto'; L15: import { spawn } from 'node:child_process'; L16: import fs from 'node:fs'; ... L23: import { getDesignSidecarPath, getLiveAnnotationsDir, readLiveServerInfo, removeLiveServerInfo, resolveDesignSidecarPath, writeLiveServerInfo, } from '../paths.js'; L24: const __dirname = path.dirname(fileURLToPath(import.meta.url)); L25: const staticDir = path.join(__dirname, 'static'); ... L129: function broadcast(msg) { L130: const data = 'data: ' + JSON.stringify(msg) + '\n\n'; L131: for (const res of state.sseClients) { ... L163: if (!fs.existsSync(p)) {

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/src/tools/impeccable/live/server.jsView on unpkg · L1

.agents/skills/team-adversarial-swarm/scripts/test_aco.pyView file

•path = .agents/skills/team-adversarial-swarm/scripts/test_aco.py kind = payload_in_excluded_dir sizeBytes = 18781 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.agents/skills/team-adversarial-swarm/scripts/test_aco.pyView on unpkg

•path = .agents/skills/team-adversarial-swarm/scripts/test_aco.py kind = build_helper sizeBytes = 18781 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

.agents/skills/team-adversarial-swarm/scripts/test_aco.pyView on unpkg

Findings

8 High5 Medium7 Low

HighChild Processbin/maestro.js

HighShelldist/src/commands/stop.js

HighSame File Env Network Executiondist/src/commands/view.js

HighCommand Output Exfiltrationdist/src/commands/view.js

HighSandbox Evasion Gated Capabilitydashboard/dist-server/dashboard/src/server/routes/mcp.js

HighCross File Remote Execution Contextdist/src/tools/impeccable/live/server.js

HighRuntime Package Installdist/src/commands/view.js

HighPayload In Excluded Dir.agents/skills/team-adversarial-swarm/scripts/test_aco.py

MediumDynamic Requiredist/src/migrations/_template.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helper.agents/skills/team-adversarial-swarm/scripts/test_aco.py

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowWeak Cryptodist/src/tools/core-memory.js

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

11 flagged

bin/maestro.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import { spawnSync } from 'node:child_process';

3import { fileURLToPath } from 'node:url';

High

Child Process

Package source references child process execution.

bin/maestro.jsView on unpkg · L1

4import {

5 shouldApplyWasmFlags,

6 processHasWasmRuntimeFlags,

7 buildRelaunchArgv,

8 isNodeVersionWasmSensitive,

9} from '../dist/src/utils/wasm-relaunch.js';

11const WASM_RELAUNCH_GUARD = 'MAESTRO_WASM_RELAUNCHED';

12const SCRIPT_PATH = fileURLToPath(import.meta.url);

13const scriptArgs = process.argv.slice(2);

14const needsWasmFlags = shouldApplyWasmFlags(scriptArgs);

16if (

17 needsWasmFlags &&

18 !processHasWasmRuntimeFlags() &&

19 !process.env[WASM_RELAUNCH_GUARD] &&

20 !process.env.MAESTRO_NO_WASM_RELAUNCH

21) {

dist/src/commands/stop.jsView file

Lines 1-39javascript

1// ---------------------------------------------------------------------------

2// `maestro stop` — stop the running maestro dashboard server

3//

4// Strategy (3-stage):

5// 1. Try graceful shutdown via POST /api/shutdown

6// 2. Find process by port via netstat and kill it

7// 3. Force kill fallback (--force or when graceful fails)

8// ---------------------------------------------------------------------------

9import { exec } from 'node:child_process';

10// ---------------------------------------------------------------------------

dist/src/migrations/_template.jsView file

Lines 24-55javascript

24 // 1. Read current state

25 let state;

26 try {

27 state = JSON.parse(readFileSync(statePath, 'utf8'));

28 }

29 catch (e) {

30 return { success: false

dist/src/tools/core-memory.jsView file

Lines 11-51javascript

11import { join } from 'path';

12import { createHash } from 'crypto';

13import { homedir } from 'os';

14import { getProjectRoot } from '../utils/path-validator.js';

15// --- Zod Schema ---

16const OperationEnum

dist/src/commands/view.jsView file

Lines 161-216javascript

161 ...process.env,

162 PORT: String(port),

163 HOST: host,

164 WORKFLOW_ROOT: workflowRoot,

165 },

166 stdio: 'inherit',

167 });

168 tuiChild.on

dashboard/dist-server/dashboard/src/server/routes/mcp.jsView file

Lines 1-30javascript

1/**

2 * MCP Routes — Handles all MCP server management API endpoints.

3 *

4 * Ported from ccw's mcp-routes.ts, adapted to Hono framework.

5 * Manages MCP server configs across Claude (.claude.json, .mcp.json),

6 * Codex (config.toml), and enterprise managed-mcp.json.

7 */

8import { readFileSync, writeFileSync, existsSync, mkdirSync } from 'node:fs';

9import { join, dirname } from

dist/src/tools/impeccable/live/server.jsView file

Lines 1-21javascript

2// Licensed under the Apache License, Version 2.0

3// Modifications: Converted to TypeScript, adapted for maestro CLI architecture.

4/**

5 * Live variant mode server (self-contained, zero dependencies).

6 *

7 * Serves the browser script (/live.js), the detection overlay (/detect.js),

8 * uses Server-Sent Events (SSE) for server->browser push, and HTTP POST for

9 * browser->server events. Agent communicates via HTTP long-poll (/poll).

10 *

11 * Converted from live-server.mjs to TypeScript.

.agents/skills/team-adversarial-swarm/scripts/test_aco.pyView file

•path = .agents/skills/team-adversarial-swarm/scripts/test_aco.py kind = payload_in_excluded_dir sizeBytes = 18781 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.agents/skills/team-adversarial-swarm/scripts/test_aco.pyView on unpkg

•path = .agents/skills/team-adversarial-swarm/scripts/test_aco.py kind = build_helper sizeBytes = 18781 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

.agents/skills/team-adversarial-swarm/scripts/test_aco.pyView on unpkg