registry / markhub-local-agent / 0.1.3

markhub-local-agent@0.1.3

MarkHub 로컬 에이전트 데몬 — 유저 컴퓨터의 claude code / codex 로 브라우저 유즈 잡을 실행

AI Security Review

scanned 2h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User runs `maki-agent pair`, then `maki-agent run` or `maki-agent install`.

Impact

A paired server can direct read/navigation tasks against sites logged into the dedicated browser profile; generated task results are returned to that server.

Mechanism

Remote-job browser-agent execution with constrained read-only MCP tooling.

Rationale

The package is not malicious by source evidence, but its deliberate remote-job execution against authenticated browser sessions is a meaningful dangerous capability. Explicit commands and layered read-only restrictions reduce risk, while persistence is opt-in rather than install-time.

Evidence

package.jsondist/index.jsdist/api.jsdist/poller.jsdist/service.jsdist/backends/claude.jsdist/backends/codex.jsdist/mcp/readonly-proxy.jsdist/config.js~/.maki-agent/config.json~/.maki-agent/token~/.maki-agent/chrome-profile~/.maki-agent/codex-home~/.maki-agent/codex-work

Decision evidence

public snapshot

AI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

`dist/poller.js` claims remote jobs and sends generated results to the paired server.
`dist/backends/codex.js` and `dist/backends/claude.js` run agent SDKs using the user's authenticated browser sessions.
`dist/service.js` creates persistent login-start services, but only through `maki-agent install`.
`dist/mcp/readonly-proxy.js` downloads/starts Playwright MCP through `npx` at runtime.

Evidence against

`package.json` has no preinstall, install, or postinstall hook; `prepublishOnly` only builds.
`dist/index.js` requires explicit `pair`, `run`, or `install` commands; importing does not start work.
`dist/mcp/readonly-proxy.js` code-filters MCP calls to a read/navigation allowlist.
`dist/backends/claude.js` denies shell, filesystem, web-fetch/search, and browser mutation tools.
`dist/backends/codex.js` uses an isolated work directory and read-only sandbox.
No hidden endpoint, credential harvesting, payload execution, or foreign AI-agent config mutation was found.

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 13 file(s), 50.7 KB of source, external domains: www.apple.com

Source & flagged code

4 flagged

dist/service.jsView file

Lines 1-32javascript

1/**

2 * 시스템 등록 — 로그인 시 자동 실행.

3 * - macOS: launchd LaunchAgent (~/Library/LaunchAgents), RunAtLoad+KeepAlive, 즉시 시작.

4 * - Linux: systemd --user 서비스, enable --now 로 즉시 시작.

5 * - Windows: 시작프로그램 폴더에 .cmd 배치 — 다음 로그인부터 적용.

6 *

7 * 서비스는 headless `run`(자동 로그인 창 없음)으로 돈다. 무인 데몬이 임의로 브라우저 창을 띄우지 않게

8 * 하려는 것 — 로그인이 필요한 사이트는 `maki-agent login <domain>` 으로 미리 등록해 둔다.

9 *

10 * 디바이스 토큰이 폐기되면 poller 가 exit(1) 하지만 KeepAlive/Restart 로 재기동되어 401 루프가 된다.

11 * 이 경우 `maki-agent uninstall` 로 등록을 해제해야 멈춘다(README 안내).

12 */

13import { execFileSync } from "child_process";

14import * as fs from "fs";

High

Child Process

Package source references child process execution.

dist/service.jsView on unpkg · L12

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/service.jsView on unpkg · L12

15import * as os from "os";

16import * as path from "path";

17import { AGENT_HOME } from "./config.js";

18const LABEL = "ink.markhub.local-agent";

19const LOG_PATH = path.join(AGENT_HOME, "agent.log");

20/**

21 * launchd/systemd 에 박을 실행 인자: [node 절대경로, 엔트리 경로].

22 * 전역 설치 시 argv[1] 은 전역 bin 심링크(…/bin/maki-agent)일 수 있으나 node 가 실행 시 따라가므로 무방하며,

23 * 런타임의 playwrightMcpServer(entry) 와도 동일하게 유지된다.

24 */

25function resolveEntry() {

26 return { node: process.execPath, entry: path.resolve(process.argv[1] ?? "") };

27}

28/** 서비스 PATH — node 가 있는 디렉토리를 최우선으로(nvm/fnm/volta/asdf 대응). npx 가 여기 있다. */

29function servicePathEnv(node) {

30 return `${path.dirname(node)}:/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin`;

31}

32/** best-effort 실행 — 실패해도 무시(미등록/파일없음/명령부재). */

•matchType = previous_version_dangerous_delta matchedPackage = markhub-local-agent@0.1.1 matchedIdentity = npm:bWFya2h1Yi1sb2NhbC1hZ2VudA:0.1.1 similarity = 0.455 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/service.jsView on unpkg

dist/mcp/readonly-proxy.jsView file

Lines 18-58javascript

18/** 화이트리스트 밖 tools/call 인지 (단일 메시지 기준). */

19function isBlockedCall(m) {

20 return m?.method === "tools/call" && !ALLOW.has(m?.params?.name);

21}

22/** JSON-RPC 는 줄단위(개행 구분, 메시지 내 개행 없음) — 부분 청크를 버퍼링해 한 줄씩 넘긴다. */

23function onLines(stream

Source & flagged code

4 flagged · loading source

dist/service.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/service.jsView on unpkg

12*/ L13: import { execFileSync } from "child_process"; L14: import * as fs from "fs";

High

Child Process

Package source references child process execution.

dist/service.jsView on unpkg · L12

12*/ L13: import { execFileSync } from "child_process"; L14: import * as fs from "fs"; ... L53: function plistPath() { L54: return path.join(os.homedir(), "Library", "LaunchAgents", `${LABEL}.plist`); L55: } ... L82: // 재설치 대비: 기존 등록을 먼저 내리고(bootout) 다시 올린다(bootstrap). 미등록이면 bootout 실패 → 무시. L83: quiet(() => execFileSync("launchctl", ["bootout", `gui/${uid}/${LABEL}`], { stdio: "ignore" })); L84: execFileSync("launchctl", ["bootstrap", `gui/${uid}`, p], { stdio: "ignore" }); ... L126: function startupCmdPath() { L127: const appdata = process.env.APPDATA || path.join(os.homedir(), "AppData", "Roaming"); L128: return path.join(appdata, "Microsoft", "Windows", "Start Menu", "Programs", "Startup", "maki-agent.cmd");

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/service.jsView on unpkg · L12

dist/mcp/readonly-proxy.jsView file

38export function runReadonlyProxy(playwrightArgs) { L39: const child = spawn("npx", playwrightArgs, { stdio: ["pipe", "pipe", "inherit"] }); L40: child.on("exit", (code) => process.exit(code ?? 0));

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/mcp/readonly-proxy.jsView on unpkg · L38

Findings

1 Critical3 High4 Medium6 Low

CriticalPrevious Version Dangerous Deltadist/service.js

HighChild Processdist/service.js

HighShell

HighRuntime Package Installdist/mcp/readonly-proxy.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/service.js

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

4 flagged

dist/service.jsView file

Lines 1-32javascript

1/**

2 * 시스템 등록 — 로그인 시 자동 실행.

3 * - macOS: launchd LaunchAgent (~/Library/LaunchAgents), RunAtLoad+KeepAlive, 즉시 시작.

4 * - Linux: systemd --user 서비스, enable --now 로 즉시 시작.

5 * - Windows: 시작프로그램 폴더에 .cmd 배치 — 다음 로그인부터 적용.

6 *

7 * 서비스는 headless `run`(자동 로그인 창 없음)으로 돈다. 무인 데몬이 임의로 브라우저 창을 띄우지 않게

8 * 하려는 것 — 로그인이 필요한 사이트는 `maki-agent login <domain>` 으로 미리 등록해 둔다.

9 *

10 * 디바이스 토큰이 폐기되면 poller 가 exit(1) 하지만 KeepAlive/Restart 로 재기동되어 401 루프가 된다.

11 * 이 경우 `maki-agent uninstall` 로 등록을 해제해야 멈춘다(README 안내).

12 */

13import { execFileSync } from "child_process";

14import * as fs from "fs";

High

Child Process

Package source references child process execution.

dist/service.jsView on unpkg · L12

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/service.jsView on unpkg · L12

15import * as os from "os";

16import * as path from "path";

17import { AGENT_HOME } from "./config.js";

18const LABEL = "ink.markhub.local-agent";

19const LOG_PATH = path.join(AGENT_HOME, "agent.log");

20/**

21 * launchd/systemd 에 박을 실행 인자: [node 절대경로, 엔트리 경로].

22 * 전역 설치 시 argv[1] 은 전역 bin 심링크(…/bin/maki-agent)일 수 있으나 node 가 실행 시 따라가므로 무방하며,

23 * 런타임의 playwrightMcpServer(entry) 와도 동일하게 유지된다.

24 */

25function resolveEntry() {

26 return { node: process.execPath, entry: path.resolve(process.argv[1] ?? "") };

27}

28/** 서비스 PATH — node 가 있는 디렉토리를 최우선으로(nvm/fnm/volta/asdf 대응). npx 가 여기 있다. */

29function servicePathEnv(node) {

30 return `${path.dirname(node)}:/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin`;

31}

32/** best-effort 실행 — 실패해도 무시(미등록/파일없음/명령부재). */

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/service.jsView on unpkg

dist/mcp/readonly-proxy.jsView file

Lines 18-58javascript

18/** 화이트리스트 밖 tools/call 인지 (단일 메시지 기준). */

19function isBlockedCall(m) {

20 return m?.method === "tools/call" && !ALLOW.has(m?.params?.name);

21}

22/** JSON-RPC 는 줄단위(개행 구분, 메시지 내 개행 없음) — 부분 청크를 버퍼링해 한 줄씩 넘긴다. */

23function onLines(stream