registry / osai-agent / 4.2.68

osai-agent@4.2.68

OS AI Agent - YOUR AI AGENT

AI Security Review

scanned 1d ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User runs osai-agent commands such as run, connect, mcp, skills, or provider.

Impact

Potential high-impact system changes if the user authorizes or runs the agent in coding/no-confirm paths; no malicious autonomous package behavior found.

Mechanism

agent-controlled command/file/SSH/MCP execution via CLI

Policy narrative

The package implements a legitimate but powerful AI agent CLI. When invoked, it can ask a remote worker for tool calls, then run local commands, modify files, browse/fetch URLs, use MCP tools, and execute SSH commands. These are dangerous dual-use agent capabilities, but source inspection did not find install-time execution, hidden persistence, credential harvesting/exfiltration, or unconsented mutation of foreign AI-agent control surfaces.

Rationale

Source inspection supports a warn-level dangerous agent capability finding, not a malicious package block. The risky behavior is explicit CLI functionality and package-aligned, with no lifecycle-triggered control hijack or concrete exfiltration path confirmed.

Evidence

package.jsonsrc/index.jssrc/agent/prompt.jssrc/agent/react-loop.jssrc/agent/loop/tool-executor.jssrc/safety/check.jssrc/tools/local.jssrc/tools/mcp-client.jssrc/commands/mcp.jssrc/services/ssh.jssrc/services/server-url.js~/.osai-agent/sessions~/.osai-agent/todos~/.osai-agent/skills~/.osai-agent/instructions.md~/.osai-agent/instructions.m~/.osai-agent/instructions.txt.osai-agent-instructions.md.osai-agent-instructions.txt

Network endpoints2

wss://OLOJEDE-osai-agent-server.hf.spaceOLOJEDE-osai-agent-server.hf.space

Decision evidence

public snapshot

AI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

src/agent/prompt.js grants broad LOCAL_CMD, file write/delete, RUN_SCRIPT, SSH, web, browser, and MCP tools to the agent.
src/safety/check.js auto-approves coding-mode write tools and command writes; src/index.js exposes run --no-confirm.
src/agent/react-loop.js sends conversation history, cwd/meta, skills and MCP tool descriptions to the configured server /stream.
src/commands/mcp.js and src/tools/mcp-client.js let users register stdio/http MCP servers and execute their tools.
src/services/ssh.js and src/tools/ssh.js support SSH credential use and remote command execution.

Evidence against

package.json has no npm lifecycle hooks, so install does not execute package code.
No writes to foreign AI-agent control surfaces such as CLAUDE.md, .mcp.json, Codex, Cursor, or Claude settings were found.
Network traffic is package-aligned CLI/server operation with user login/configuration.
SSH private-key pattern in src/services/ssh.js is validation logic, not an embedded secret.
Dangerous primitives are exposed through an explicitly user-invoked AI/sysadmin CLI rather than import-time execution.
Local sessions/todos/skills are under the package-owned ~/.osai-agent namespace.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 89 file(s), 713 KB of source, external domains: agent.osai.dev, api.anthropic.com, api.cerebras.ai, api.cohere.ai, api.deepinfra.com, api.deepseek.com, api.fireworks.ai, api.groq.com, api.hyperbolic.xyz, api.lingyiwanwu.com, api.mistral.ai, api.moonshot.ai, api.novita.ai, api.openai.com, api.perplexity.ai, api.siliconflow.cn, api.studio.nebius.ai, api.together.ai, api.x.ai, codestral.mistral.ai, dashscope.aliyuncs.com, generativelanguage.googleapis.com, html.duckduckgo.com, integrate.api.nvidia.com, models.github.ai, ollama.com, open.bigmodel.cn, openrouter.ai, osaix.vercel.app, qianfan.baidubce.com, router.huggingface.co

Source & flagged code

7 flagged

src/services/ssh.jsView file

Lines 1-42javascript

1// SSH connection manager

2import { Client } from 'ssh2';

3import { DEFAULTS } from '../utils/constants.js';

4import { logger } from '../utils/logger.js';

6/**

7 * Validate SSH private key format before connection

8 */

9const validateSshPrivateKey = (privateKey) => {

10 if (!privateKey || typeof privateKey !== 'string') {

11 throw new Error('Invalid SSH private key: missing or not a string');

12 }

14 const trimmedKey = privateKey.trim();

16 // Check for common SSH private key headers

17 const validKeyPatterns = [

18 /^-----BEGIN ([A-Z ]+) PRIVATE KEY-----/,

19 /^-----BEGIN OPENSSH PRIVATE KEY-----/,

Critical

Critical Secret

Package contains a critical-looking secret pattern.

src/services/ssh.jsView on unpkg · L19

Critical

Secret Pattern

OpenSSH private key in src/services/ssh.js

src/services/ssh.jsView on unpkg · L19

20 /^-----BEGIN RSA PRIVATE KEY-----/,

Critical

Secret Pattern

RSA private key in src/services/ssh.js

src/services/ssh.jsView on unpkg · L20

21 /^-----BEGIN DSA PRIVATE KEY-----/,

22 /^-----BEGIN EC PRIVATE KEY-----/,

Critical

Secret Pattern

EC private key in src/services/ssh.js

src/services/ssh.jsView on unpkg · L22

23 /^-----BEGIN ED25519 PRIVATE KEY-----/,

24 /^-----BEGIN ENCRYPTED PRIVATE KEY-----/,

25 ];

27 const isValidFormat = validKeyPatterns.some(pattern => pattern.test(trimmedKey));

29 if (!isValidFormat) {

30 throw new Error('Invalid SSH private key format: must be a valid PEM-formatted private key');

31 }

33 // Check for key footer

34 if (!trimmedKey.includes('-----END')) {

35 throw new Error('Invalid SSH private key: missing END marker');

36 }

38 // Basic length check

39 if (trimmedKey.length < 100) {

40 throw new Error('Invalid SSH private key: too short to be valid');

41 }

src/agent/react-loop.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = osai-agent@4.2.66 matchedIdentity = npm:b3NhaS1hZ2VudA:4.2.66 similarity = 0.933 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/agent/react-loop.jsView on unpkg

src/ui/components/ConfirmationDialog.jsView file

Lines 21-45javascript

21 setValue(v => v + input);

22 }

23 });

25 const isDangerous = details?.isDangerous || details?.tier === 'DANGEROUS';

26 const tool

src/agent/loop/tool-executor.jsView file

Lines 223-263javascript

223

224 // PLAN mode: block any write or dangerous operation

225 if (this.executionMode === EXECUTION_MODES.PLAN) {

226 const planSafety = checkSafety(toolCall, this.mode);

227 if (planSafety.tier !== SAFETY_TIERS

Source & flagged code

7 flagged · loading source

src/services/ssh.jsView file

19patternName = private_key_openssh severity = critical line = 19 matchedText = /^-----B...--/,

Critical

Critical Secret

Package contains a critical-looking secret pattern.

src/services/ssh.jsView on unpkg · L19

19patternName = private_key_openssh severity = critical line = 19 matchedText = /^-----B...--/,

Critical

Secret Pattern

OpenSSH private key in src/services/ssh.js

src/services/ssh.jsView on unpkg · L19

20patternName = private_key_rsa severity = critical line = 20 matchedText = /^-----B...--/,

Critical

Secret Pattern

RSA private key in src/services/ssh.js

src/services/ssh.jsView on unpkg · L20

22patternName = private_key_ec severity = critical line = 22 matchedText = /^-----B...--/,

Critical

Secret Pattern

EC private key in src/services/ssh.js

src/services/ssh.jsView on unpkg · L22

src/agent/react-loop.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/agent/react-loop.jsView on unpkg

src/ui/components/ConfirmationDialog.jsView file

41patternName = generic_password severity = medium line = 41 matchedText = h(Text, ...')),

Medium

Secret Pattern

Hardcoded password in src/ui/components/ConfirmationDialog.js

src/ui/components/ConfirmationDialog.jsView on unpkg · L41

src/agent/loop/tool-executor.jsView file

243patternName = generic_password severity = medium line = 243 matchedText = this.rea...)));

Medium

Secret Pattern

Hardcoded password in src/agent/loop/tool-executor.js

src/agent/loop/tool-executor.jsView on unpkg · L243

Findings

4 Critical1 High4 Medium5 Low

CriticalCritical Secretsrc/services/ssh.js

CriticalSecret Patternsrc/services/ssh.js

HighPrevious Version Dangerous Deltasrc/agent/react-loop.js

MediumNetwork

MediumEnvironment Vars

MediumSecret Patternsrc/ui/components/ConfirmationDialog.js

MediumSecret Patternsrc/agent/loop/tool-executor.js

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

7 flagged

src/services/ssh.jsView file

Lines 1-42javascript

1// SSH connection manager

2import { Client } from 'ssh2';

3import { DEFAULTS } from '../utils/constants.js';

4import { logger } from '../utils/logger.js';

6/**

7 * Validate SSH private key format before connection

8 */

9const validateSshPrivateKey = (privateKey) => {

10 if (!privateKey || typeof privateKey !== 'string') {

11 throw new Error('Invalid SSH private key: missing or not a string');

12 }

14 const trimmedKey = privateKey.trim();

16 // Check for common SSH private key headers

17 const validKeyPatterns = [

18 /^-----BEGIN ([A-Z ]+) PRIVATE KEY-----/,

19 /^-----BEGIN OPENSSH PRIVATE KEY-----/,

Critical

Critical Secret

Package contains a critical-looking secret pattern.

src/services/ssh.jsView on unpkg · L19

Critical

Secret Pattern

OpenSSH private key in src/services/ssh.js

src/services/ssh.jsView on unpkg · L19

20 /^-----BEGIN RSA PRIVATE KEY-----/,

Critical

Secret Pattern

RSA private key in src/services/ssh.js

src/services/ssh.jsView on unpkg · L20

21 /^-----BEGIN DSA PRIVATE KEY-----/,

22 /^-----BEGIN EC PRIVATE KEY-----/,

Critical

Secret Pattern

EC private key in src/services/ssh.js

src/services/ssh.jsView on unpkg · L22

23 /^-----BEGIN ED25519 PRIVATE KEY-----/,

24 /^-----BEGIN ENCRYPTED PRIVATE KEY-----/,

25 ];

27 const isValidFormat = validKeyPatterns.some(pattern => pattern.test(trimmedKey));

29 if (!isValidFormat) {

30 throw new Error('Invalid SSH private key format: must be a valid PEM-formatted private key');

31 }

33 // Check for key footer

34 if (!trimmedKey.includes('-----END')) {

35 throw new Error('Invalid SSH private key: missing END marker');

36 }

38 // Basic length check

39 if (trimmedKey.length < 100) {

40 throw new Error('Invalid SSH private key: too short to be valid');

41 }

src/agent/react-loop.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/agent/react-loop.jsView on unpkg

src/ui/components/ConfirmationDialog.jsView file

Lines 21-45javascript

21 setValue(v => v + input);

22 }

23 });

25 const isDangerous = details?.isDangerous || details?.tier === 'DANGEROUS';

26 const tool

src/agent/loop/tool-executor.jsView file

Lines 223-263javascript

223

224 // PLAN mode: block any write or dangerous operation

225 if (this.executionMode === EXECUTION_MODES.PLAN) {

226 const planSafety = checkSafety(toolCall, this.mode);

227 if (planSafety.tier !== SAFETY_TIERS