spendctl@0.5.2
A corporate card and expense policy for AI agents: budgets, approvals and receipts for x402, MPP and any HTTP 402 API.
AI Security Review
scanned 3d ago · by lpm-firewall-aiLicensed sidecars automatically report account-linked usage data to the vendor, and the README does not clearly disclose those fields or the default check-in behavior. The check-in is relevant to license management and has an opt-out, so this is warning-level telemetry rather than malicious credential theft.
Static reason
No blocking static signals were detected.
Trigger
By default when a licensed sidecar starts, unless SPENDCTL_CHECKIN=off; check-ins recur daily.
Impact
The package operator receives account-linked usage data and the sidecar identifier without clear advance disclosure in the README.
Mechanism
POSTs the sidecar ID, version, month, governed usage count, and agent count with the license key as a bearer token.
AI rationale
Licensed sidecars automatically report account-linked usage data to the vendor, and the README does not clearly disclose those fields or the default check-in behavior. The check-in is relevant to license management and has an opt-out, so this is warning-level telemetry rather than malicious credential theft.
Evidence
dist/checkin.jsdist/index.jsREADME.md.spendctl/sidecar.id.spendctl/checkin.json.spendctl/license.key
Network endpoints2
api.spendctl.dev/v1/sidecar/checkinSPENDCTL_CONTROL_URL (configurable endpoint)
Decision evidence
public snapshotAI called this Suspicious at 83.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Starting a licensed, non-sandbox sidecar starts a check-in automatically.
- The check-in reports a sidecar ID, package version, month, governed usage count, and agent count.
- The request sends the license key as a bearer token to the control-plane check-in endpoint.
- The README describes license keys and control-plane features but does not explain that these usage fields are sent automatically.
Evidence against
- The manifest has no lifecycle scripts, so this behavior is not triggered during installation.
- The check-in has a documented opt-out through SPENDCTL_CHECKIN=off and supports license renewal and revocation.
Behavioral surface
ChildProcessEnvironmentVarsFilesystem
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
5 flaggeddist/index.jsView file
422function maybeStartCheckin(p, config, license, sidecar, agentCount) {
if (license.plan.source !== "key" || isSandbox(config))
return undefined;
if (checkinOff()) {
out(`${c.dim("checkin")} off (SPENDCTL_CHECKIN=off)`);
return un
Medium
Ai Review Evidence
Starting a licensed, non-sandbox sidecar starts a check-in automatically.
dist/index.jsView on unpkg · L422228const stopCheckin = maybeStartCheckin(p, config, license, sidecar, agents.length);
const stop = async () => {
stopCheckin?.();
await running.close();
ledger.close();
rmSync(p.sidec
Medium
Ai Review Evidence
Starting a licensed, non-sandbox sidecar starts a check-in automatically.
dist/index.jsView on unpkg · L228dist/checkin.jsView file
21const body = {
sidecarId: options.sidecarId,
version: options.version,
month: new Date(now).toISOString().slice(0, 7),
governed: target.usage().used,
agents: target.agentCount,
};
let resp
Findings
6 Medium4 Low
MediumEnvironment Vars
MediumAi Review Evidencedist/index.js
MediumAi Review Evidencedist/index.js
MediumAi Review Evidencedist/checkin.js
MediumAi Review Evidencedist/checkin.js
MediumAi Review Evidencedist/checkin.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to spendctl@0.5.2.
See all versions of spendctl for other recorded verdicts.
- Review the evidence and your use of spendctl@0.5.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.