Loading npm security reports…

mercury-agent@0.5.12: Suspicious npm security report (Warn) | LPM Firewall

registry / mercury-agent / 0.5.12

mercury-agent@0.5.12

Personal AI assistant for chat platforms (WhatsApp, Slack, Discord, Telegram)

AI Security Review

scanned 16d ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. No confirmed malicious install-time behavior was found. Residual risk is an agent platform that runtime-installs first-party skills/extensions into its own Mercury global directory and can load user-installed extension code.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Explicit user CLI/runtime actions: mercury init/setup/run/add/service install, or Mercury server startup

Impact

Agent capabilities and local service persistence may be enabled within the Mercury project/app namespace when the user opts into running or installing them.

Mechanism

first-party AI agent extension and skill lifecycle management

Policy narrative

Static inspection shows a personal AI assistant framework. It can install skills/extensions and services, but these paths are explicit CLI/runtime actions and remain in Mercury-owned project/global directories or OS service locations requested by the user. No npm lifecycle hook or foreign AI-agent hijack surface was found.

Rationale

The scanner’s high-risk labels map to expected agent-platform behavior: Docker/service management, extension loading, credential checks, and package-aligned API calls. Because the package lifecycle manages AI-agent skills/extensions inside its own namespace, warn rather than block.

Evidence

package.jsonsrc/cli/mercury.tssrc/main.tssrc/extensions/installer.tssrc/extensions/loader.tssrc/extensions/skills.tsexamples/extensions/pinchtab/index.tsexamples/extensions/tradestation/index.ts

Source & flagged code

9 flagged · loading source

resources/pi-extensions/subagent/index.tsView file

14L15: import { spawn } from "node:child_process"; L16: import * as fs from "node:fs";

High

Child Process

Package source references child process execution.

resources/pi-extensions/subagent/index.tsView on unpkg · L14

examples/extensions/pinchtab/index.tsView file

10install: L11: 'npm install -g pinchtab@0.13.2 playwright && npx playwright install --with-deps chromium && CHROMIUM=$(NODE_PATH="$(npm root -g)" node -e "try{process.stdout.write(require(\'playw... L12: });

Medium

Dynamic Require

Package source references dynamic require/import behavior.

examples/extensions/pinchtab/index.tsView on unpkg · L10

src/cli/mercury.tsView file

2L3: import { spawn, spawnSync } from "node:child_process"; L4: import { ... L32: L33: const __dirname = dirname(fileURLToPath(import.meta.url)); L34: const PACKAGE_ROOT = join(__dirname, "../.."); ... L56: function isPortInUse(port: string): boolean { L57: if (process.platform === "win32") { L58: const result = spawnSync("netstat", ["-ano"], { ... L61: }); L62: return result.status === 0 && result.stdout.includes(`:${port} `); L63: }

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

src/cli/mercury.tsView on unpkg · L2

2Trigger-reachable chain: manifest.bin -> src/cli/mercury.ts L2: L3: import { spawn, spawnSync } from "node:child_process"; L4: import { ... L32: L33: const __dirname = dirname(fileURLToPath(import.meta.url)); L34: const PACKAGE_ROOT = join(__dirname, "../.."); ... L56: function isPortInUse(port: string): boolean { L57: if (process.platform === "win32") { L58: const result = spawnSync("netstat", ["-ano"], { ... L61: }); L62: return result.status === 0 && result.stdout.includes(`:${port} `); L63: }

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

src/cli/mercury.tsView on unpkg · L2

2Cross-file remote execution chain: src/cli/mercury.ts spawns [redacted].ts; helper contains network access plus dynamic code execution. L2: L3: import { spawn, spawnSync } from "node:child_process"; L4: import { ... L32: L33: const __dirname = dirname(fileURLToPath(import.meta.url)); L34: const PACKAGE_ROOT = join(__dirname, "../.."); ... L56: function isPortInUse(port: string): boolean { L57: if (process.platform === "win32") { L58: const result = spawnSync("netstat", ["-ano"], { ... L61: }); L62: return result.status === 0 && result.stdout.includes(`:${port} `); L63: }

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

src/cli/mercury.tsView on unpkg · L2

2L3: import { spawn, spawnSync } from "node:child_process"; L4: import { ... L32: L33: const __dirname = dirname(fileURLToPath(import.meta.url)); L34: const PACKAGE_ROOT = join(__dirname, "../.."); ... L56: function isPortInUse(port: string): boolean { L57: if (process.platform === "win32") { L58: const result = spawnSync("netstat", ["-ano"], { ... L61: }); L62: return result.status === 0 && result.stdout.includes(`:${port} `); L63: }

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

src/cli/mercury.tsView on unpkg · L2

container/build.shView file

•path = container/build.sh kind = build_helper sizeBytes = 623 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

container/build.shView on unpkg

examples/extensions/pdf/skill/SKILL.mdView file

442patternName = generic_password severity = medium line = 442 matchedText = user_pas...ss",

Medium

Secret Pattern

Hardcoded password in examples/extensions/pdf/skill/SKILL.md

examples/extensions/pdf/skill/SKILL.mdView on unpkg · L442

443patternName = generic_password severity = medium line = 443 matchedText = owner_pa...ss",

Medium

Secret Pattern

Hardcoded password in examples/extensions/pdf/skill/SKILL.md

examples/extensions/pdf/skill/SKILL.mdView on unpkg · L443

Source & flagged code

9 flagged

resources/pi-extensions/subagent/index.tsView file

Lines 1-34typescript

1/**

2 * Subagent Tool - Delegate tasks to specialized agents

3 *

4 * Spawns a separate `pi` process for each subagent invocation,

5 * giving it an isolated context window.

6 *

7 * Supports three modes:

8 * - Single: { agent: "name", task: "..." }

9 * - Parallel: { tasks: [{ agent: "name", task: "..." }, ...] }

10 * - Chain: { chain: [{ agent: "name", task: "... {previous} ..." }, ...] }

11 *

12 * Uses JSON mode to capture structured output from subagents.

13 */

14

15import { spawn } from "node:child_process";

16import * as fs from "node:fs";

High

Child Process

Package source references child process execution.

resources/pi-extensions/subagent/index.tsView on unpkg · L14

17import * as os from "node:os";

18import * as path from "node:path";

19import type { AgentToolResult } from "@earendil-works/pi-agent-core";

20import type { Message } from "@earendil-works/pi-ai";

21import { StringEnum } from "@earendil-works/pi-ai";

22import { type ExtensionAPI, getMarkdownTheme } from "@earendil-works/pi-coding-agent";

23import { Container, Markdown, Spacer, Text } from "@earendil-works/pi-tui";

24import { Type } from "@sinclair/typebox";

25import { type AgentConfig, type AgentScope, discoverAgents } from "./agents.js";

26

27const MAX_PARALLEL_TASKS = 8;

28const MAX_CONCURRENCY = 4;

29const COLLAPSED_ITEM_COUNT = 10;

30

31function formatTokens(count: number): string {

32 if (count < 1000) return count.toString();

33 if (count < 10000) return `${(count / 1000).toFixed(1)}k`;

34 if (count < 1000000) return `${Math.round(count / 1000)}k`;

examples/extensions/pinchtab/index.tsView file

Lines 1-30typescript

1export default function (mercury: {

2 cli(opts: { name: string; install: string }):

src/cli/mercury.tsView file

Lines 1-22typescript

1#!/usr/bin/env bun

2

3import { spawn, spawnSync } from "node:child_process";

4import {

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

src/cli/mercury.tsView on unpkg · L2

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

src/cli/mercury.tsView on unpkg · L2

High

container/build.shView file

•path = container/build.sh kind = build_helper sizeBytes = 623 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

container/build.shView on unpkg

examples/extensions/pdf/skill/SKILL.mdView file

Lines 422-463markdown

422| `extract_form_structure.py` | Extract structure from non-fillable PDFs |

423| `fill_pdf_form_with_annotations.py` | Fill non-fillable PDFs using annotations |

424

425Run any script with `python3 scripts/<name>.py --help` for usage.

426

427---

428

429## 8. Encrypt / Decrypt PDFs

430

431### Encrypt with pypdf