registry / multi-agents-cli / 1.1.53

multi-agents-cli@1.1.53

Multi-agent workflow orchestration for Claude Code — isolated git worktrees, structured state tracking, autonomous task chaining

AI Security Review

scanned 4h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. No confirmed malicious install-time attack surface. The package explicitly sets up and launches a Claude Code multi-agent workflow with broad local file/git control, including an optional dangerous skip-permissions mode.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User runs multi-agents init or npm run agent/reset in the generated project.

Impact

Can create/modify project files, git worktrees/branches, IDE settings, Claude task prompts, and reset project state when invoked by the user.

Mechanism

explicit AI-agent workflow scaffolding and command orchestration

Rationale

Source inspection shows explicit, package-aligned AI-agent orchestration with dangerous local capabilities, but no unconsented npm lifecycle hook, stealth persistence, credential theft, payload fetch, or exfiltration. Warn rather than block because the risk is user-invoked first-party agent setup and optional broad permissions.

Evidence

package.jsoninit.jslib/questions.jslib/writers.jscore/workflow/agent.jscore/workflow/reset.jscore/workflow/run.js.workflow/CLAUDE.mdclient/CLAUDE.mdbackend/CLAUDE.mdshared/wiring.config.json.agents/.frameworks/.scaffold/.config.json.scaffold/.tracking.jsonBUILD_STATE.mdTASKS_HISTORY.mdCONTRACTS.mdCLOUD_STATE.md.git/hooks/pre-commitworktrees/

Network endpoints4

registry.npmjs.org/pypi.org/pypi/github.comclaude.ai/signup

Decision evidence

public snapshot

AI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

core/workflow/agent.js generates TASK.md instructing Claude to run autonomously and execute npm run complete.
core/workflow/agent.js offers recommended full-permission launch and runs claude --dangerously-skip-permissions when selected.
init.js writes project package.json scripts, .workflow files, CLAUDE.md/.agents scaffolding, git hook, and runs npm install during explicit init.
core/workflow/reset.js contains destructive reset path deleting worktrees, branches, remote repo via gh, and project files after confirmations.

Evidence against

package.json has no preinstall/install/postinstall lifecycle hooks; bin is user-invoked init.js only.
No credential harvesting or exfiltration logic found in inspected source.
Network use is package-aligned: npm/PyPI version lookups, GitHub/gh/git remote operations, Claude signup/open commands.
Runtime npm install targets generated project dependencies or explicit Claude Code CLI install prompt, not hidden payload loading.
AI-agent files are first-party workflow scaffolding created by explicit multi-agents init/agent commands.

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 17 file(s), 275 KB of source, external domains: claude.ai, github.com, pypi.org, registry.npmjs.org

Source & flagged code

5 flagged

core/workflow/reset.jsView file

Lines 1-42javascript

1#!/usr/bin/env node

3/**

4 * Multi-Agent Monorepo Template - Reset

5 * Full project wipe with 2-step confirmation.

6 *

7 * Deletes:

8 * - All worktrees

9 * - All agent branches (local + remote)

10 * - Remote GitHub repository

11 * - All project files

12 *

13 * Run with: npm run reset

14 */

16'use strict';

18const fs = require('fs');

19const path = require('path');

20const { execSync } = require('child_process');

High

Child Process

Package source references child process execution.

core/workflow/reset.jsView on unpkg · L19

22let prompts = null;

23try { prompts = require('prompts'); } catch { prompts = null; }

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

core/workflow/reset.jsView on unpkg · L22

25// ── Self-relocate to repo root ────────────────────────────────────────────────

27const ROOT = path.join(__dirname, '..');

29// ── Colors ────────────────────────────────────────────────────────────────────

31const c = {

32 reset: '\x1b[0m',

33 bold: '\x1b[1m',

34 dim: '\x1b[2m',

35 green: '\x1b[32m',

36 yellow: '\x1b[33m',

37 red: '\x1b[31m',

38 cyan: '\x1b[36m',

39};

41const bold = (s) => `${c.bold}${s}${c.reset}`;

42const dim = (s) => `${c.dim}${s}${c.reset}`;

core/workflow/agent.jsView file

Lines 168-208javascript

168

169 return name;

170 } catch {

171 return null;

172 }

173};

174

175

176

177// ── Open new OS terminal with Claude Code CLI ───────────────────────────────

178const openTerminal

Source & flagged code

5 flagged · loading source

core/workflow/reset.jsView file

19const path = require('path'); L20: const { execSync } = require('child_process'); L21:

High

Child Process

Package source references child process execution.

core/workflow/reset.jsView on unpkg · L19

22package = multi-agents-cli; repositoryIdentity = multi-agents; dependency = prompts L22: let prompts = null; L23: try { prompts = require('prompts'); } catch { prompts = null; } L24:

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

core/workflow/reset.jsView on unpkg · L22

core/workflow/agent.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = multi-agents-cli@1.1.39 matchedIdentity = npm:bXVsdGktYWdlbnRzLWNsaQ:1.1.39 similarity = 0.647 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

core/workflow/agent.jsView on unpkg

188} else { L189: execSync(termCmd + ' -- bash -c "cd \'' + worktreePath + '\' && ' + claudeCmd + '; exec bash" &', { stdio: 'pipe' }); L190: }

High

Shell

Package source references shell execution.

core/workflow/agent.jsView on unpkg · L188

658try { L659: execSync('npm install -g @anthropic-ai/claude-code', { stdio: 'pipe' }); L660: clearInterval(spin);

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

core/workflow/agent.jsView on unpkg · L658

Findings

1 Critical4 High3 Medium3 Low

CriticalPrevious Version Dangerous Deltacore/workflow/agent.js

HighChild Processcore/workflow/reset.js

HighShellcore/workflow/agent.js

HighCopied Package Dependency Bridgecore/workflow/reset.js

HighRuntime Package Installcore/workflow/agent.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

5 flagged

core/workflow/reset.jsView file

Lines 1-42javascript

1#!/usr/bin/env node

3/**

4 * Multi-Agent Monorepo Template - Reset

5 * Full project wipe with 2-step confirmation.

6 *

7 * Deletes:

8 * - All worktrees

9 * - All agent branches (local + remote)

10 * - Remote GitHub repository

11 * - All project files

12 *

13 * Run with: npm run reset

14 */

16'use strict';

18const fs = require('fs');

19const path = require('path');

20const { execSync } = require('child_process');

High

Child Process

Package source references child process execution.

core/workflow/reset.jsView on unpkg · L19

22let prompts = null;

23try { prompts = require('prompts'); } catch { prompts = null; }

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

core/workflow/reset.jsView on unpkg · L22

25// ── Self-relocate to repo root ────────────────────────────────────────────────

27const ROOT = path.join(__dirname, '..');

31const c = {

32 reset: '\x1b[0m',

33 bold: '\x1b[1m',

34 dim: '\x1b[2m',

35 green: '\x1b[32m',

36 yellow: '\x1b[33m',

37 red: '\x1b[31m',

38 cyan: '\x1b[36m',

39};

41const bold = (s) => `${c.bold}${s}${c.reset}`;

42const dim = (s) => `${c.dim}${s}${c.reset}`;

core/workflow/agent.jsView file

Lines 168-208javascript

168

169 return name;

170 } catch {

171 return null;

172 }

173};

174

175

176

177// ── Open new OS terminal with Claude Code CLI ───────────────────────────────

178const openTerminal

Lines 638-678javascript

638 console.log('\n');

639 console.log(bold(cyan(' Multi-Agent Monorepo Template')));

640 console.log(dim(` Task Launcher - ${config.projectName}\n`));

641 separator();

642

643 // ── Entry guards ──────────────────────────────────────────────────────────────

644

645 guards.validateConfig(config, ROOT);

646 const tracking = guards.loadTracking(ROOT, config);

647

648 // ── Claude Code CLI gate ───────────────────────────────────────────────────

649

650 const checkClaudeAuth = () => {

651 try { execSync('claude --version', { stdio: 'pipe' }); return true; } catch { return false; }

652 };

653

654 const installClaudeCode = () => {

655 const frames = ['⠋','⠙','⠹','⠸','⠼','⠴','⠦','⠧','⠇','⠏'];

656 let i = 0;

657 const spin = setInterval(() => process.stdout.write(`\r ${frames[i++ % frames.length]} Installing Claude Code CLI...`), 60);

658 try {

659 execSync('npm install -g @anthropic-ai/claude-code', { stdio: 'pipe' });

660 clearInterval(spin);

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

core/workflow/agent.jsView on unpkg · L658

661 process.stdout.write('\r' + ' '.repeat(40) + '\r');

662 console.log(` ${green('✓')} Claude Code CLI installed\n`);

663 return true;

664 } catch {

665 clearInterval(spin);

666 process.stdout.write('\r' + ' '.repeat(40) + '\r');

667 console.log(` ${red('✖')} Installation failed - try manually: ${cyan('npm install -g @anthropic-ai/claude-code')}\n`);

668 return false;

669 }

670 };

671

672 const runClaudeLogin = () => {

673 const { spawnSync } = require('child_process');

674 console.log(`\n ${dim('Running claude login...')}\n`);

675 const result = spawnSync('claude', ['login'], { stdio: 'inherit' });

676 return result.status === 0;

677 };

678