rafey-shell@1.0.5
Renamed to rabot. Install with npm install -g @arafeymasood/rabot
An AI-powered shell with personalized LLM assistance
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe package sends the current working-directory path to its own chat service with every query, although that path is unnecessary for the advertised Q&A feature. The reviewed flow did not show credential or file collection, so this warrants a warning rather than a malicious verdict.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A user submits a query in the interactive CLI.
Impact
The service receives the user’s local directory path with each query; no credential or file-content exfiltration was identified.
Mechanism
The CLI builds a prompt containing process.cwd() and POSTs that prompt with conversation history to the default chat endpoint.
AI rationale
The package sends the current working-directory path to its own chat service with every query, although that path is unnecessary for the advertised Q&A feature. The reviewed flow did not show credential or file collection, so this warrants a warning rather than a malicious verdict.
Evidence
dist/services/LLMService.jsdist/shell/RafeyShell.js
Network endpoints1
rafey-shell.vercel.app/api/chat
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- LLMService uses the package’s chat endpoint by default, with an environment variable override.
- Each request sends the assembled prompt and conversation history.
- The prompt includes the current working directory, which is sent with each query and is unnecessary for the advertised Rafey Q&A feature.
- The CLI sends a query after the user enters an interactive line.
- The prepare script invokes the build script.
Evidence against
- The request sends user queries and conversation history to the package’s own chat service, which is central to the CLI’s function.
- I found no automatic credential or file collection in the reviewed request path.
- The flagged zero-width character is in biography text, not executable control flow.
Behavioral surface
EnvironmentVarsNetwork
HighEntropyStringsUrlStrings
Source & flagged code
5 flaggeddist/services/LLMService.jsView file
73contains invisible/control Unicode U+200B (zero width space)
- Research Scientist at Guy's and St Thomas'<U+200B> NHS Foundation Trust (July 2018 - October 2018): Worked closely with senior physicians @ Guy's Hospital to develop a web application to detect irregularities in MRI scans. The tool analyz
Critical
Trojan Source Unicode
Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.
dist/services/LLMService.jsView on unpkg · L73•Trigger-reachable chain: scripts.start -> dist/cli.js -> dist/shell/RafeyShell.js -> dist/services/LLMService.js
Reachable file contains a blocking source-risk pattern.
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/services/LLMService.jsView on unpkg19this.apiEndpoint = process.env.RAFEY_SHELL_API_URL || 'https://rafey-shell.vercel.app/api/chat';
// Model name can be passed but is handled server-side via environment vari
Medium
Findings
2 Critical1 High5 Medium4 Low
CriticalTrojan Source Unicodedist/services/LLMService.js
CriticalTrigger Reachable Dangerous Capabilitydist/services/LLMService.js
HighNode Builtin Dependency Squatpackage.json
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumAi Review Evidencedist/services/LLMService.js
MediumAi Review Evidencedist/services/LLMService.js
LowNon Install Lifecycle Scripts
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to rafey-shell@1.0.5.
See all versions of rafey-shell for other recorded verdicts.
- Review the evidence and your use of rafey-shell@1.0.5 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.