registry / sentinelayer-cli / 0.38.0

sentinelayer-cli@0.38.0

Scaffold Sentinelayer spec/prompt/guide artifacts with secure browser auth and token bootstrap.

AI Security Review

scanned 2h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

Explicit CLI commands such as `swarm pentest --execute`, `mcp bridge init-vscode`, or session wake resume.

Impact

Can probe an approved remote target, modify project AI-tool configuration, and launch a resumed Codex process with caller-selected bypass settings.

Mechanism

User-invoked live security probes, agent bridge configuration, and external CLI process execution.

Rationale

This is not concrete malware: source inspection found no lifecycle execution, hidden payload, or unconsented foreign control-surface mutation. It remains a warn-worthy dangerous capability package because it exposes explicit live pentesting, agent-control configuration, bypass-capable process launching, and environment-selected secret output.

Evidence

package.jsonbin/sentinelayer-cli.jssrc/cli.jssrc/swarm/pentest.jssrc/commands/swarm.jssrc/commands/mcp.jssrc/session/wake/codex.jssrc/legacy-cli.jssrc/mcp/registry.js.vscode/mcp.json

Network endpoints2

api.sentinelayer.comapi.aidenid.com

Decision evidence

public snapshot

AI called this Suspicious at 86.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

`src/swarm/pentest.js` sends live auth-bypass, rate-limit, XSS, SQLi, and privilege probes when `execute` is true.
`src/commands/swarm.js` exposes the live probes through explicit `swarm pentest --execute`; default is dry-run.
`src/commands/mcp.js` explicitly writes `.vscode/mcp.json`, creating an MCP bridge to the package CLI.
`src/session/wake/codex.js` can construct Codex resume calls with `--dangerously-bypass-approvals-and-sandbox` when explicitly requested.
`src/legacy-cli.js` supports writing resolved GitHub secret values to an env-selected `SENTINELAYER_SECRET_SINK_FILE`.

Evidence against

`package.json` has no `preinstall`, `install`, `postinstall`, or `prepare` lifecycle hook.
All package binaries only invoke `runCli()`; no install-time or import-time payload executes.
Pentest network activity requires explicit `--execute`, an approved target ID, verified status, host matching, and allowed policy paths/methods/scenarios.
The MCP bridge and session-guide writes are explicit CLI commands, not automatic npm-install mutations.
No `eval`, `Function`, VM use, native loader, or remote code download/execution was found in inspected source.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 342 file(s), 3.64 MB of source, external domains: api.aidenid.com, api.anthropic.com, api.openai.com, api.sentinelayer.com, api.telegram.org, developers.openai.com, docs.anthropic.com, example.com, generativelanguage.googleapis.com, github.com, json-schema.org, json.schemastore.org, platform.openai.com, sentinelayer.com, www.npmjs.com

Source & flagged code

6 flagged

src/swarm/pentest.jsView file

Lines 330-370javascript

330 "X-Sentinelayer-Pentest": "input-validation-xss",

331 },

332 body: JSON.stringify({

333 query: xssPayload,

334 email: "user@example.com",

335 }),

336 evaluation: "reflect_or_reject",

337 expectedPayload: xssPayload,

338 owaspCategory: "A03:2021-Injection",

339 },

340 {

341 checkId: "input-validation-sqli",

342 method: "POST",

343 path: inputPath,

344 headers: {

345 "Content-Type": "application/json",

346 "X-Sentinelayer-Pentest": "input-validation-sqli",

347 },

348 body: JSON.stringify({

349 username: sqlPayload,

350 password: "example-password",

Medium

Secret Pattern

Package contains a possible secret pattern.

src/swarm/pentest.jsView on unpkg · L350

351 }),

352 evaluation: "reflect_or_error",

353 expectedPayload: sqlPayload,

354 owaspCategory: "A03:2021-Injection",

355 },

356 ];

357 }

358

359 if (scenarioId === "privilege-escalation") {

360 ensureMethodAllowed(policy, "GET", scenarioId);

361 const adminPath = selectPolicyPath(["/admin", "/admin/users"], policy.allowedPaths);

362 return [

363 {

364 checkId: "privilege-escalation-admin-endpoint",

365 method: "GET",

366 path: adminPath,

367 headers: {

368 Authorization: "Bearer standard-user-token",

369 "X-Sentinelayer-Pentest": "privilege-escalation",

370 },

src/ingest/engine.jsView file

Lines 1-21javascript

1import { execFile } from "node:child_process";

2import { createHash } from "node:crypto";

High

Child Process

Package source references child process execution.

src/ingest/engine.jsView on unpkg · L1

3import fs from "node:fs";

4import fsp from "node:fs/promises";

5import

src/legacy-cli.jsView file

Lines 582-622javascript

582 return `${sshMatch[1]}/${sshMatch[2]}`;

583 }

584

585 const httpsMatch = remote.match(/^https?:\/\/github\.com

src/agents/jules/tools/runtime-audit.jsView file

Lines 64-104javascript

64 if (apiResult.available) return apiResult;

65 } catch { /* API unavailable — fall back to local */ }

67 try {

68 const outputPath = path.join(

69 input.path || process.cwd(),

src/commands/session.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = sentinelayer-cli@0.34.1 matchedIdentity = npm:c2VudGluZWxheWVyLWNsaQ:0.34.1 similarity = 0.917 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/commands/session.jsView on unpkg

Source & flagged code

6 flagged · loading source

src/swarm/pentest.jsView file

350patternName = generic_password severity = medium line = 350 matchedText = password...rd",

Medium

Secret Pattern

Package contains a possible secret pattern.

src/swarm/pentest.jsView on unpkg · L350

src/ingest/engine.jsView file

1import { execFile } from "node:child_process"; L2: import { createHash } from "node:crypto";

High

Child Process

Package source references child process execution.

src/ingest/engine.jsView on unpkg · L1

61".bash": "Shell", L62: ".ps1": "PowerShell", L63: ".dockerfile": "Docker",

High

Shell

Package source references shell execution.

src/ingest/engine.jsView on unpkg · L61

src/legacy-cli.jsView file

602function getGitCommand() { L603: return String(process.env.SENTINELAYER_GIT_BIN || "").trim() || "git"; L604: } ... L607: const gitCommand = getGitCommand(); L608: const probe = spawnSync(gitCommand, ["rev-parse", "--is-inside-work-tree"], { L609: cwd, ... L615: function buildGithubCloneUrl(repoSlug) { L616: const base = String(DEFAULT_GITHUB_CLONE_BASE_URL || "https://github.com").trim().replace(/\/+$/g, ""); L617: return `${base}/${normalizeRepoSlug(repoSlug)}.git`;

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

src/legacy-cli.jsView on unpkg · L602

src/agents/jules/tools/runtime-audit.jsView file

84stdio: ["pipe", "pipe", "pipe"], L85: shell: true, // Windows: npx is npx.cmd, needs shell resolution L86: });

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

src/agents/jules/tools/runtime-audit.jsView on unpkg · L84

src/commands/session.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/commands/session.jsView on unpkg

Findings

1 Critical4 High4 Medium5 Low

CriticalPrevious Version Dangerous Deltasrc/commands/session.js

HighChild Processsrc/ingest/engine.js

HighShellsrc/ingest/engine.js

HighSame File Env Network Executionsrc/legacy-cli.js

HighRuntime Package Installsrc/agents/jules/tools/runtime-audit.js

MediumSecret Patternsrc/swarm/pentest.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

86%Warn

Verdict confidence

IntentDangerous Capability

TypeAI-agent capability abuse

False-positive riskLow

Review stagesource_first_review

Firewall policyWarn-only AI-agent capability risk

Package metadata

npm

Maintainerscarther

Version0.39.0

PublishedJul 12, 2026

LicenseMIT

Dependencies16

Integrityverified

Package size875 KB

Files344

Keywordssentinelayersentinelayer-cliomar-gatesecurityscaffoldcli

LinksRepository Homepage Issues

Runtime surface

package.json

Entrypointsbin → create-sentinelayer, sentinel, sentinelayer-cli +3

Runtimenode ^20.0.0 || ^22.0.0

Artifact3.69 MB · 344 files1 signature(s) · provenance

Install lifecycleNo install hooks · other: check, devtestbot:install-browsers, docs:build, release:publish +5

Behavioral surface

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellHighEntropyStringsTelemetryUrlStringsManifest: clean

Source & flagged code

6 flagged

src/swarm/pentest.jsView file

Lines 330-370javascript

330 "X-Sentinelayer-Pentest": "input-validation-xss",

331 },

332 body: JSON.stringify({

333 query: xssPayload,

334 email: "user@example.com",

335 }),

336 evaluation: "reflect_or_reject",

337 expectedPayload: xssPayload,

338 owaspCategory: "A03:2021-Injection",

339 },

340 {

341 checkId: "input-validation-sqli",

342 method: "POST",

343 path: inputPath,

344 headers: {

345 "Content-Type": "application/json",

346 "X-Sentinelayer-Pentest": "input-validation-sqli",

347 },

348 body: JSON.stringify({

349 username: sqlPayload,

350 password: "example-password",

Medium

Secret Pattern

Package contains a possible secret pattern.

src/swarm/pentest.jsView on unpkg · L350

351 }),

352 evaluation: "reflect_or_error",

353 expectedPayload: sqlPayload,

354 owaspCategory: "A03:2021-Injection",

355 },

356 ];

357 }

358

359 if (scenarioId === "privilege-escalation") {

360 ensureMethodAllowed(policy, "GET", scenarioId);

361 const adminPath = selectPolicyPath(["/admin", "/admin/users"], policy.allowedPaths);

362 return [

363 {

364 checkId: "privilege-escalation-admin-endpoint",

365 method: "GET",

366 path: adminPath,

367 headers: {

368 Authorization: "Bearer standard-user-token",

369 "X-Sentinelayer-Pentest": "privilege-escalation",

370 },

src/ingest/engine.jsView file

Lines 1-21javascript

1import { execFile } from "node:child_process";

2import { createHash } from "node:crypto";

High

Child Process

Package source references child process execution.

src/ingest/engine.jsView on unpkg · L1

3import fs from "node:fs";

4import fsp from "node:fs/promises";

5import

src/legacy-cli.jsView file

Lines 582-622javascript

582 return `${sshMatch[1]}/${sshMatch[2]}`;

583 }

584

585 const httpsMatch = remote.match(/^https?:\/\/github\.com

src/agents/jules/tools/runtime-audit.jsView file

Lines 64-104javascript

64 if (apiResult.available) return apiResult;

65 } catch { /* API unavailable — fall back to local */ }

67 try {

68 const outputPath = path.join(

69 input.path || process.cwd(),

src/commands/session.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/commands/session.jsView on unpkg