registry / AI-agent capability abuse / min-agent / 3.3.2609221214

min-agent@3.3.2609221214

Minimal AI coding agent with tool use, MCP, and skills support

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

The explicit configuration capability warrants a warning under the agent-control policy, but the source does not establish an automatic or unconsented attack. There is no install-time trigger or confirmed data-exfiltration path.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

A user runs an applicable min-agent setup, MCP, or skills command.

Impact

A user can configure agent capabilities through this CLI; no confirmed unconsented mutation, exfiltration, or remote payload execution was established.

Mechanism

The CLI writes configuration files under its .min-agent directory and exposes commands that enable MCP configuration.

AI rationale

Evidence

dist/cli.js.min-agent/mcp.json.min-agent/skills

Decision evidence

public snapshot

AI called this Suspicious at 82.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The package has no automatic install lifecycle hook; its listed scripts are development, build, test, packaging, and publish tasks.
The CLI creates a skills directory and an MCP configuration file in its own configuration area.
The CLI exposes MCP server enablement through an explicit command action, so agent-control configuration can be changed when the user invokes the CLI.

Evidence against

No package-controlled network endpoint or automatic credential export was identified.
No preinstall, install, or postinstall script is declared.

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 3 file(s), 1.54 MB of source, external domains: 127.0.0.1, api.example.com, api.openai.com, example.com, fireclawl.xc.lonae.com, github.com, google.serper.dev, loki.lonae.com, mcp.exa.ai, models.dev, models.lonae.com, openrouter.ai, reactjs.org, registry.npmjs.org, searxng.xc.lonae.com, www.w3.org

Source & flagged code

9 flagged

dist/cli.jsView file

1Source sends the broad process environment to a literal external destination. L1: import{createRequire as vl}from"node:module";var Ol=Object.create;var{getPrototypeOf:jl,defineProperty:pM,getOwnPropertyNames:ul}=Object;var Sl=Object.prototype.hasOwnProperty;func... L2: `)}displayWidth(A){return HV(A).length}styleTitle(A){return A}styleUsage(A){return A.split(" ").map((B)=>{if(B==="[options]")return this.styleOptionText(B);if(B==="[command]")retur... ... L12: (Did you mean one of ${I.join(", ")}?)`;if(I.length===1)return` L13: (Did you mean ${I[0]}?)`;return""}Cr.suggestSimilar=Er});var NV=eB((Ur)=>{var gr=RQ("node:events").EventEmitter,lM=RQ("node:child_process"),j0=RQ("node:path"),$9=RQ("node:fs"),YQ=R... L14: - specify the name in Command constructor or using .name()`);if(B=B||{},B.isDef

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/cli.jsView on unpkg · L1

•matchType = previous_version_dangerous_delta matchedPackage = min-agent@0.7.1 matchedIdentity = npm:bWluLWFnZW50:0.7.1 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli.jsView on unpkg

12(Did you mean one of ${I.join(", ")}?)`;if(I.length===1)return` L13: (Did you mean ${I[0]}?)`;return""}Cr.suggestSimilar=Er});var NV=eB((Ur)=>{var gr=RQ("node:events").EventEmitter,lM=RQ("node:child_process"),j0=RQ("node:path"),$9=RQ("node:fs"),YQ=R... L14: - specify the name in Command constructor or using .name()`);if(B=B||{},B.isDefault)this._defaultCommandName=A._name;if(B.noHelp||B.hidden)A._hidden=!0;return this._registerCommand...

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L12

15Expecting one of '${Q.join("', '")}'`);if(this._lifeCycleHooks[A])this._lifeCycleHooks[A].push(B);else this._lifeCycleHooks[A]=[B];return this}exitOverride(A){if(A)this._exitCallba... L16: - already used by option '${B.flags}'`)}this._initOptionGroup(A),this.options.push(A)}_registerCommand(A){let B=(I)=>{return[I.name()].concat(I.aliases())},Q=B(A).find((I)=>this._... L17: - either make a new Command for each call to parse, or stop storing options as properties`);this._name=this._savedState._name,this._scriptPath=null,this.rawArgs=[],this._optionValu...

High

Shell

Package source references shell execution.

dist/cli.jsView on unpkg · L15

25Expecting one of '${Q.join("', '")}'`);let I=`${A}Help`;return this.on(I,(E)=>{let g;if(typeof B==="function")g=B({error:E.error,command:E.command});else g=B;if(g)E.write(`${g} L26: `)}),this}_outputHelpIfRequested(A){let B=this._getHelpOption();if(B&&A.find((I)=>B.is(I)))this.outputHelp(),this._exit(0,"commander.helpDisplayed","(outputHelp)")}}function XV(A){... L27: `),Q=hV().map((E)=>`(subpath ${uV(MQ.resolve(E))})`).join(` ... L39: `}function dV(){if(f8("/usr/bin/bwrap"))return"/usr/bin/bwrap";return"/usr/local/bin/bwrap"}function iV(A,B,Q){let I=["--die-with-parent","--ro-bind","/","/","--dev","/dev","--proc... L40: ${TV}`:SV,G}function C3(A){return A==="off"?"未隔离":A==="strict"?"严格隔离":"工作区隔离"}function lV(A){return A==="deny"?"禁止联网":"允许联网"}function D3(A=NE()){return`${C3(A.mode)}，

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli.jsView on unpkg · L25

24`),this._exit(0,"commander.version",A)}),this}description(A,B){if(A===void 0&&B===void 0)return this._description;if(this._description=A,B)this._argsDescription=B;return this}summa... L25: Expecting one of '${Q.join("', '")}'`);let I=`${A}Help`;return this.on(I,(E)=>{let g;if(typeof B==="function")g=B({error:E.error,command:E.command});else g=B;if(g)E.write(`${g} L26: `)}),this}_outputHelpIfRequested(A){let B=this._getHelpOption();if(B&&A.find((I)=>B.is(I)))this.outputHelp(),this._exit(0,"commander.helpDisplayed","(outputHelp)")}}function XV(A){... L27: `),Q=hV().map((E)=>`(subpath ${uV(MQ.resolve(E))})`).join(` ... L39: `}function dV(){if(f8("/usr/bin/bwrap"))return"/usr/bin/bwrap";return"/usr/local/bin/bwrap"}function iV(A,B,Q){let I=["--die-with-parent","--ro-bind","/","/","--dev",

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/cli.jsView on unpkg · L24

24Trigger-reachable command-output exfiltration chain: manifest.bin -> bin/min-agent.js -> dist/cli.js L24: `),this._exit(0,"commander.version",A)}),this}description(A,B){if(A===void 0&&B===void 0)return this._description;if(this._description=A,B)this._argsDescription=B;return this}summa... L25: Expecting one of '${Q.join("', '")}'`);let I=`${A}Help`;return this.on(I,(E)=>{let g;if(typeof B==="function")g=B({error:E.error,command:E.command});else g=B;if(g)E.write(`${g} L26: `)}),this}_outputHelpIfRequested(A){let B=this._getHelpOption();if(B&&A.find((I)=>B.is(I)))this.outputHelp(),this._exit(0,"commander.helpDisplayed","(outputHelp)")}}function XV(A){... L27: `),Q=hV().map((E)=>`(subpath ${uV(MQ.resolve(E))})`).join(` ... L39: `}function dV(){if(f8("/usr/bin/bwrap"))return"/usr/bin/bwrap";re

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/cli.jsView on unpkg · L24

•matchType = normalized_sha256 matchedPackage = min-agent@2.0.0 matchedPath = dist/cli.js matchedIdentity = npm:bWluLWFnZW50:2.0.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli.jsView on unpkg

100`)});var Qf={};sB(Qf,{runWriteConfig:()=>ts});async function ts(A){let B=[],Q=!0;if(A.sandbox!==void 0||A.network!==void 0){let I=D6({positionals:[],flagMode:A.sandbox,flagNetwork:... L101: `)),!Q)process.exitCode=1}var If=h(()=>{H$();K$();U$();Y$()});function U6(A,B,Q){let I=A==="openai"?"openai":A==="ollama"?"ollama":es(B)??"provider";return At(I,Q)}function tF(A){l... L102:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/cli.jsView on unpkg · L100

Source & flagged code

9 flagged · loading source

dist/cli.jsView file

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/cli.jsView on unpkg · L1

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli.jsView on unpkg

Findings

2 Critical6 High4 Medium6 Low

CriticalHardcoded Runtime Data Exfiltrationdist/cli.js

CriticalPrevious Version Dangerous Deltadist/cli.js

HighChild Processdist/cli.js

HighShelldist/cli.js

HighSame File Env Network Executiondist/cli.js

HighCommand Output Exfiltrationdist/cli.js

HighTrigger Reachable Command Output Exfiltrationdist/cli.js

HighKnown Malware Source Similaritydist/cli.js

MediumDynamic Requiredist/cli.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

Affected versions and remediation

This report applies to min-agent@3.3.2609221214.

See all versions of min-agent for other recorded verdicts.

Review the evidence and your use of min-agent@3.3.2609221214 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-22 09:45:02.058Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code