oft-agt@0.5.1
Agent de liaison serveur pour Oftone Builder
AI Security Review
scanned 3d ago · by lpm-firewall-aiVersion 0.5.1 automatically sends runtime command-usage telemetry to the package’s relay, and the CLI offers no opt-out. The data is limited to usage metrics, so this warrants a warning rather than a malicious verdict.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
After a user connects the agent and starts it, the background agent sends usage data when its WebSocket opens and every 60 seconds.
Impact
The service receives command usage patterns without a documented CLI opt-out; no credential or message-content exfiltration was identified.
Mechanism
The generated bot records command names, success status, and duration. The agent aggregates these events locally and sends hourly records with a source identifier over its relay connection.
AI rationale
Version 0.5.1 automatically sends runtime command-usage telemetry to the package’s relay, and the CLI offers no opt-out. The data is limited to usage metrics, so this warrants a warning rather than a malicious verdict.
Evidence
templates/bot.mjsusage.mjscli.mjsusage.json
Network endpoints1
oftone-agent-relay.hugocoutant2008.workers.dev
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The generated bot records each slash command’s name, success status, and duration.
- The agent sends aggregated usage records, including a source identifier, over its relay connection.
- The agent flushes usage data when the socket opens and then every 60 seconds.
- The CLI help lists commands and options but does not expose a telemetry opt-out.
Evidence against
- The collected data is limited to command names, counts, failures, durations, and a source identifier; the reviewed code does not add tokens or message contents to usage records.
- The Discord bot token is validated against Discord API endpoints and stored locally in an encrypted envelope.
- The package has no lifecycle scripts, and its default command starts an explicit device login.
- The relay connection supports the package’s stated purpose of managing a Discord bot through the Oftone service.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkWebSocket
Source & flagged code
5 flaggedruntime/lifecycle.mjsView file
1import { spawn } from 'node:child_process';
L2: import { readFile, writeFile, open, unlink, mkdir, rename, stat, rm, realpath, link } from 'node:fs/promises';
High
Child Process
Package source references child process execution.
runtime/lifecycle.mjsView on unpkg · L1cli.mjsView file
•matchType = previous_version_dangerous_delta
matchedPackage = oft-agt@0.5.0
matchedIdentity = npm:b2Z0LWFndA:0.5.0
similarity = 0.895
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
cli.mjsView on unpkg10import { fileURLToPath } from 'node:url';
L11: import { spawn } from 'node:child_process';
L12: import WebSocket from 'ws';
L13: import { writeBot, compile } from './compiler.mjs';
...
L20:
L21: const baseHome = process.env.OFTONE_AGENT_HOME || path.join(homedir(), '.oftone-agent');
L22: let home = baseHome, configPath, secretPath, keyPath;
Findings
1 Critical4 High3 Medium4 Low
CriticalPrevious Version Dangerous Deltacli.mjs
HighChild Processruntime/lifecycle.mjs
HighSame File Env Network Executioncli.mjs
HighCommand Output Exfiltrationcli.mjs
HighSandbox Evasion Gated Capabilityruntime/device-login.mjs
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to oft-agt@0.5.1.
See all versions of oft-agt for other recorded verdicts.
- Review the evidence and your use of oft-agt@0.5.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.