sdlc-agent-4-enterprise-server@1.53.12
Code Intelligence MCP Server — multi-agent SDLC pipeline with semantic memory, code graph, and draw.io integration
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe source confirms a caller-invoked command execution capability whose local mode has reduced isolation and inherits process environment values. That supports a warning for dangerous capability, while the inspected paths do not establish malicious execution or credential exfiltration.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
A caller invokes the sandbox command tool; local mode is the default on non-Linux systems unless full isolation is enabled, and Docker unavailability can cause fallback to local mode.
Impact
Commands can access host resources and environment values available to the package process.
Mechanism
The local executor launches the supplied command through a shell and inherits the package process environment.
AI rationale
The source confirms a caller-invoked command execution capability whose local mode has reduced isolation and inherits process environment values. That supports a warning for dangerous capability, while the inspected paths do not establish malicious execution or credential exfiltration.
Evidence
dist/modules/sandbox/tools/tool-definitions.jsdist/modules/sandbox/tools/tool-handlers.jsdist/config/SandboxConfig.jsdist/modules/sandbox/ExecutionManager.jsdist/modules/sandbox/executors/LocalExecutor.js
Decision evidence
public snapshotAI called this Suspicious at 87.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The LLM error helper summarizes nested connection errors; the inspected receiver does not establish a separate attack.
- The sandbox exposes command execution through a named tool, and its handler passes the caller’s command to the execution manager.
- Non-Linux systems default to local mode unless full isolation is enabled; local fallback is enabled by default.
- If Docker is unavailable, a requested Docker session can fall back to local execution.
- The local executor passes process environment values and runs the supplied command through a shell.
- The package prepare hook exits successfully without other work.
Evidence against
- Command execution requires a caller to invoke the sandbox tool; the inspected paths do not show hidden or automatic command execution.
- The inspected credential references are for local test requests and credentials supplied per request to the Pega route; they do not establish an unrelated credential recipient.
Behavioral surface
ChildProcessCryptoDynamicRequire
Source & flagged code
19 flagged · loading sourcetest-index.cjsView file
15patternName = generic_password
severity = medium
line = 15
Medium
1const http = require('http');
L2: function post(url, body, headers) {
Medium
Dynamic Require
Package source references dynamic require/import behavior.
test-index.cjsView on unpkg · L1start.jsView file
4import { fileURLToPath } from "url";
L5: import { spawn } from "child_process";
L6: import { randomUUID } from "crypto";
High
Findings
12 High9 Medium8 Low
HighChild Processstart.js
HighShelldist/modules/sandbox/executors/LocalExecutor.js
HighSame File Env Network Executiondist/viewer/3d-force-graph.min.js
HighSandbox Evasion Gated Capabilitydist/engine/tools/drawio-renderers.js
HighRuntime Package Installtests/e2e/setup/global-setup.ts
HighPayload In Excluded Dirservers/fastapi/tests/mocks/normalizers.py
HighSemantic Analysis Limiteddist/modules/memory/llm/LLMInitializer.js#virtual:normalized:round1
HighKnown Malware Source Similaritydist/engine/tools/drawio-renderers.js
HighKnown Malware Source Similaritydist/modules/sandbox/executors/LocalExecutor.js
HighKnown Malware Source Similaritydist/engine/graph/file-resolver.js
Affected versions and remediation
This report applies to sdlc-agent-4-enterprise-server@1.53.12.
See all versions of sdlc-agent-4-enterprise-server for other recorded verdicts.
- Review the evidence and your use of sdlc-agent-4-enterprise-server@1.53.12 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.