AI Security Review
scanned 3h ago · by lpm-firewall-aiReview flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Explicit CLI/MCP tool calls such as skill_init_personal or skill_edit_personal
Impact
An authorized agent can persist new personal skills/scripts in its own Switchroom/Claude workspace; no unconsented npm install mutation was found.
Mechanism
agent-writable personal skill installation
Rationale
Static inspection did not confirm scanner claims of an encrypted temp payload or install-time attack, but the package intentionally grants explicit user/agent commands to mutate a Claude agent skills control surface. Under policy this warrants a warning rather than a publish block.
Evidence
package.jsondist/cli/switchroom.jstelegram-plugin/start.jstelegram-plugin/shared/bot-runtime.tsvendor/hindsight-memory/tests/conftest.py~/.switchroom/agents/<agent>/.claude/skills/personal-<name>~/.switchroom-config/agents/<agent>/personal-skills/<name>~/.switchroom/agents/<agent>/.claude/skills-trash/<name>-<timestamp>
Network endpoints5
api.telegram.orgus.i.posthog.comgraph.microsoft.com/v1.0www.googleapis.comapi.notion.com
Decision evidence
public snapshotAI called this Suspicious at 78.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- dist/cli/switchroom.js exposes MCP tools skill_init_personal/skill_edit_personal that write agent .claude skills without operator approval.
- dist/cli/switchroom.js validates then writes supplied skill files and chmods shell/python scripts executable.
- dist/cli/switchroom.js mirrors personal skills into ~/.switchroom-config when present.
Evidence against
- package.json has no preinstall/install/postinstall hook; only prepublishOnly build/lint/test.
- Scanner encrypted-payload hint appears to match legitimate vault AES-GCM code, not embedded dropper execution.
- telegram-plugin/start.js only imports bundled dist/server.js or source fallback.
- telegram-plugin/shared/bot-runtime.ts child_process calls are package-aligned switchroom CLI wrappers using argv arrays.
- Bidi scan found only a zero-width char used to defuse markdown fences, not Trojan Source control flow.
- vendor/hindsight-memory/tests/conftest.py is test fixture isolation, not payload execution.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsTelemetryUrlStrings
Oversized source lightweight scan
dist/cli/switchroom.js3.35 MB file, sampled 256 KB
FilesystemChildProcessEnvironmentVarsShellHighEntropyStringsUrlStringsgithub.com
telegram-plugin/dist/gateway/gateway.js2.66 MB file, sampled 256 KB
NetworkChildProcessEnvironmentVarsHighEntropyStringsUrlStringsapi.telegram.orgt.mewww.typescriptlang.org
Source & flagged code
14 flagged · loading sourcedist/host-control/main.jsView file
10429var EventEmitter2 = __require("node:events").EventEmitter;
L10430: var childProcess = __require("node:child_process");
L10431: var path2 = __require("node:path");
High
Child Process
Package source references child process execution.
dist/host-control/main.jsView on unpkg · L1042910875}
L10876: const execArgv = process2.execArgv ?? [];
L10877: if (execArgv.includes("-e") || execArgv.includes("--eval") || execArgv.includes("-p") || execArgv.includes("--print")) {
High
2457if (typeof node_buffer.Buffer === "function") {
L2458: return node_buffer.Buffer.from(src, "base64");
L2459: } else if (typeof atob === "function") {
...
L4916: yield* this.next(token);
L4917: yield* this.end(forceDoc, endOffset);
L4918: }
L4919: *next(token) {
L4920: if (node_process.env.LOG_STREAM)
L4921: console.dir(token, { depth: null });
...
L7789: }
L7790: if (process.platform === "win32") {
L7791: const osRelease = os.release().split(".");
High
Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
dist/host-control/main.jsView on unpkg · L24572457Cross-file remote execution chain: dist/host-control/main.js spawns dist/agent-scheduler/index.js; helper contains network access plus dynamic code execution.
L2457: if (typeof node_buffer.Buffer === "function") {
L2458: return node_buffer.Buffer.from(src, "base64");
L2459: } else if (typeof atob === "function") {
...
L4916: yield* this.next(token);
L4917: yield* this.end(forceDoc, endOffset);
L4918: }
L4919: *next(token) {
L4920: if (node_process.env.LOG_STREAM)
L4921: console.dir(token, { depth: null });
...
L7789: }
L7790: if (process.platform === "win32") {
L7791: const osRelease = os.release().split(".");
High
Cross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
dist/host-control/main.jsView on unpkg · L2457telegram-plugin/dist/server.jsView file
12703sourceCode = this.opts.code.process(sourceCode, sch);
L12704: const makeValidate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode);
L12705: const validate = makeValidate(this, this.scope.get());
Low
Eval
Package source references a known benign dynamic code generation pattern.
telegram-plugin/dist/server.jsView on unpkg · L12703telegram-plugin/start.jsView file
25const target = existsSync(distPath) ? distPath : sourcePath;
L26: await import(target);
Medium
Dynamic Require
Package source references dynamic require/import behavior.
telegram-plugin/start.jsView on unpkg · L25telegram-plugin/shared/bot-runtime.tsView file
175contains invisible/control Unicode U+200B (zero width space)
const safe = text.replace(/```/g, '`<U+200B>``')
Critical
Trojan Source Unicode
Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.
telegram-plugin/shared/bot-runtime.tsView on unpkg · L1758* - `createRobustApiCall` — thin re-export of createRetryApiCall pre-wired
L9: * with stderr logging (mirrors how gateway.ts constructs `robustApiCall`).
L10: * - `makeSwitchroomExec` / `makeSwitchroomExecCombined` — factory fns for
...
L26: import { run, type RunnerHandle } from '@grammyjs/runner'
L27: import { execFileSync, spawnSync } from 'child_process'
L28: import { createHash } from 'crypto'
...
L116: const res = await prev(method, payload, signal)
L117: process.stderr.write(
L118: `tg-post method=${method} chat=${chat} thread=${thread} parse_mode=${parseMode} bytes=${bytes} hash=${hash} status=ok err=- code=- desc=-${tagSuffix}\n`,
...
L203: export function makeSwitchroomExec(cfg: CliConfig = {}) {
L204: const cli = cfg.cliPath ?? process.env.SWITCHROOM_CLI_PATH ?? 'switchroom'
L205: const config = cfg.configPath ?? process.env.SWITCHROOM_CONFIG
Low
Weak Crypto
Package source references weak cryptographic algorithms.
telegram-plugin/shared/bot-runtime.tsView on unpkg · L8dist/cli/switchroom.jsView file
•context = nction renderProfileClaudeTemplate(profileName, profilesRoot = PROFILES_ROOT) {\n const profileDir = resolve4(profilesRoot, profileName);\n const hbsPath = join4(profileDir, "CLAUDE.md.hbs");\n const outPath = join4(profileDir, "CLAUDE.md");\n if (!existsSync6(hbsPath)) {\n return { wrote: false, path: outPath };\n }\n const source = readFileSync6(hbsPath, "utf-8");\n const template = import_handlebars.default.compile(source, { noEscape: true });\n const rendered = template({ profile: profileName });\n try {\n writeFileSync(outPath, rendered, "utf-8");\n return { wrote: true, path: outPath };\n } catch (err) {\n const code = err.code;\n if (code === "EACCES" || code === "EROFS" || code === "EPERM") {\n console.warn(`Note: profile CLAUDE.md at ${outPath} is not writable (${code}); ` + `skipping bookkeeping render. Agent scaffolds re-render the .hbs ` + `into their own dir, so this is non-fatal.`);\n return { wrote: false, path: outPath };\n }\n throw err;\n }\n}\nvar import_handlebars, PROFILES_ROOT, SHARE
Critical
Encrypted Payload Temp Execution
Source decrypts an embedded payload, writes it to disk, and executes it through a child process.
dist/cli/switchroom.jsView on unpkg•path = dist/cli/switchroom.js
kind = oversized_source_file
sizeBytes = 3511251
magicHex = [redacted]
High
Oversized Source File
Package contains source files above the static scanner size ceiling.
dist/cli/switchroom.jsView on unpkg•path = dist/cli/switchroom.js
kind = oversized_cli_entrypoint
sizeBytes = 3511251
magicHex = [redacted]
Medium
Oversized Cli Entrypoint
Package contains an oversized executable-looking CLI entrypoint.
dist/cli/switchroom.jsView on unpkgbin/turn-pacing-hook.shView file
•path = bin/turn-pacing-hook.sh
kind = build_helper
sizeBytes = 3963
magicHex = [redacted]
Medium
Ships Build Helper
Package ships non-JavaScript build or shell helper files.
bin/turn-pacing-hook.shView on unpkgvendor/hindsight-memory/tests/conftest.pyView file
•path = vendor/hindsight-memory/tests/conftest.py
kind = payload_in_excluded_dir
sizeBytes = 2548
magicHex = [redacted]
High
Payload In Excluded Dir
Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.
vendor/hindsight-memory/tests/conftest.pyView on unpkgtelegram-plugin/tests/secret-detect.test.tsView file
198patternName = private_key_rsa
severity = critical
line = 198
matchedText = const pe...----
Critical
Secret Pattern
RSA private key in telegram-plugin/tests/secret-detect.test.ts
telegram-plugin/tests/secret-detect.test.tsView on unpkg · L198Findings
3 Critical6 High6 Medium8 Low
CriticalEncrypted Payload Temp Executiondist/cli/switchroom.js
CriticalTrojan Source Unicodetelegram-plugin/shared/bot-runtime.ts
CriticalSecret Patterntelegram-plugin/tests/secret-detect.test.ts
HighChild Processdist/host-control/main.js
HighShelldist/host-control/main.js
HighSandbox Evasion Gated Capabilitydist/host-control/main.js
HighCross File Remote Execution Contextdist/host-control/main.js
HighPayload In Excluded Dirvendor/hindsight-memory/tests/conftest.py
HighOversized Source Filedist/cli/switchroom.js
MediumDynamic Requiretelegram-plugin/start.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperbin/turn-pacing-hook.sh
MediumOversized Cli Entrypointdist/cli/switchroom.js
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvaltelegram-plugin/dist/server.js
LowWeak Cryptotelegram-plugin/shared/bot-runtime.ts
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings