registry / pilotswarm-sdk / 0.3.2

pilotswarm-sdk@0.3.2

A durable execution runtime for GitHub Copilot SDK agents. Crash recovery, durable timers, session dehydration, and multi-node scaling — powered by duroxide.

AI Security Review

scanned 2h ago · by lpm-firewall-ai

Runtime resource-manager tools invoke `kubectl` through shell-interpreted `execSync` strings. Unvalidated tool arguments can alter the command beyond the intended Kubernetes operation.

Static reason

No blocking static signals were detected.

Trigger

A worker registers `createResourceManagerTools` and an agent/user invokes infrastructure or scaling tools with crafted namespace or deployment input.

Impact

Arbitrary commands may run with the worker process privileges and its configured Kubernetes credentials.

Mechanism

Shell command injection through interpolated `kubectl` arguments.

Rationale

Source inspection found a concrete runtime shell-injection vulnerability but no malicious install hook, exfiltration chain, or stealth behavior. Warn rather than block as a critical vulnerability in an explicitly registered management capability.

Evidence

package.jsondist/index.jsdist/facts-store.jsdist/resourcemgr-tools.jsplugins/mgmt/agents/resourcemgr.agent.mddist/session-store.js

Decision evidence

public snapshot

AI called this Suspicious at 93.0% confidence as Critical Vulnerability with low false-positive risk.

Evidence for warning

`dist/resourcemgr-tools.js` interpolates tool-supplied namespace/deployment into `execSync` shell commands.
`scale_workers` can execute injected shell syntax through unvalidated `namespace` or `deployment` parameters.
Packaged Resource Manager agent exposes `scale_workers` to an LLM-controlled tool surface.

Evidence against

`package.json` has no preinstall, install, postinstall, or prepare lifecycle hook.
`dist/index.js` only re-exports modules; import does not trigger command execution.
Dynamic import in `dist/facts-store.js` loads the explicitly selected optional Horizon peer.
No hard-coded exfiltration endpoint, credential harvesting, or stealth persistence was found.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

WildcardDependency

scanned 108 file(s), 4.92 MB of source, external domains: ossrdbms-aad.database.windows.net

Source & flagged code

1 flagged

dist/facts-store.jsView file

Lines 119-159javascript

119 },

120 };

121}

122function computeScopeKey(key, shared, sessionId) {

123 if (shared)

124 return `shared:${key}`;

125 if (!sessionId)

126 throw new Error("Session-scoped facts require a sessionId.");

127 return `session:${sessionId}:${key}`;

128}

129function normalizeLikePattern(pattern) {

130 if (!pattern)

131 return undefined;

132 if (pattern.includes("%"))

133 return pattern;

134 if (pattern.includes("*"))

135 return pattern.replaceAll("*", "%");

136 return pattern;

137}

138// Specifier for the OPTIONAL horizon provider peer. The `: string` annotation is

139// load-bearing: it widens the type away from a string literal so TypeScript does

140// NOT eagerly type-resolve `import(HORIZON_STORE_PACKAGE)` at compile time.

141// Resolving it would pull pilotswarm-horizon-store's emitted .d.ts into this

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/facts-store.jsView on unpkg · L139

142// compile, which re-imports `pilotswarm-sdk` and cycles back onto THIS package's

143// own dist/ — a TS5055 self-overwrite once dist/ exists. The peer is loaded

144// purely structurally at runtime (`mod` is `any`), so nothing is lost. Do NOT

145// inline this back to a string literal.

146const HORIZON_STORE_PACKAGE = "pilotswarm-horizon-store";

147export async function createFactStoreForUrl(storeUrl, schema, opts = {}) {

148 if (!(storeUrl.startsWith("postgres://") || storeUrl.startsWith("postgresql://"))) {

149 throw new Error("PilotSwarm facts require a PostgreSQL store. " +

150 `Received unsupported store URL: ${storeUrl}`);

151 }

152 if (opts.provider === "horizon") {

153 // Guarded dynamic import: the SDK builds/runs without the provider

154 // package. A missing package is a clear, actionable error ONLY when the

155 // horizon provider is explicitly selected.

156 let mod;

157 try {

158 mod = await import(HORIZON_STORE_PACKAGE);

159 }

Source & flagged code

1 flagged · loading source

dist/facts-store.jsView file

139// load-bearing: it widens the type away from a string literal so TypeScript does L140: // NOT eagerly type-resolve `import(HORIZON_STORE_PACKAGE)` at compile time. L141: // Resolving it would pull pilotswarm-horizon-store's emitted .d.ts into this

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/facts-store.jsView on unpkg · L139

Findings

3 Medium4 Low

MediumDynamic Requiredist/facts-store.js

MediumEnvironment Vars

MediumWildcard Dependency

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

1 flagged

dist/facts-store.jsView file

Lines 119-159javascript

119 },

120 };

121}

122function computeScopeKey(key, shared, sessionId) {

123 if (shared)

124 return `shared:${key}`;

125 if (!sessionId)

126 throw new Error("Session-scoped facts require a sessionId.");

127 return `session:${sessionId}:${key}`;

128}

129function normalizeLikePattern(pattern) {

130 if (!pattern)

131 return undefined;

132 if (pattern.includes("%"))

133 return pattern;

134 if (pattern.includes("*"))

135 return pattern.replaceAll("*", "%");

136 return pattern;

137}

138// Specifier for the OPTIONAL horizon provider peer. The `: string` annotation is

139// load-bearing: it widens the type away from a string literal so TypeScript does

140// NOT eagerly type-resolve `import(HORIZON_STORE_PACKAGE)` at compile time.

141// Resolving it would pull pilotswarm-horizon-store's emitted .d.ts into this

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/facts-store.jsView on unpkg · L139

142// compile, which re-imports `pilotswarm-sdk` and cycles back onto THIS package's

143// own dist/ — a TS5055 self-overwrite once dist/ exists. The peer is loaded

144// purely structurally at runtime (`mod` is `any`), so nothing is lost. Do NOT

145// inline this back to a string literal.

146const HORIZON_STORE_PACKAGE = "pilotswarm-horizon-store";

147export async function createFactStoreForUrl(storeUrl, schema, opts = {}) {

148 if (!(storeUrl.startsWith("postgres://") || storeUrl.startsWith("postgresql://"))) {

149 throw new Error("PilotSwarm facts require a PostgreSQL store. " +

150 `Received unsupported store URL: ${storeUrl}`);

151 }

152 if (opts.provider === "horizon") {

153 // Guarded dynamic import: the SDK builds/runs without the provider

154 // package. A missing package is a clear, actionable error ONLY when the

155 // horizon provider is explicitly selected.

156 let mod;

157 try {

158 mod = await import(HORIZON_STORE_PACKAGE);

159 }