terminal-smart-cli@0.69.0
Terminal Smart no seu terminal — pergunte, analise logs por pipe e orquestre agentes de IA. Comando: ts
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThe package is not malicious by source evidence, but it intentionally provides a remote-model-to-local-command bridge with broad system impact. Flag as a warning for dangerous capability rather than block it.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
User runs `ts agente`, `ts meta`, or a routed interactive CLI task after login.
Impact
Approved or misclassified commands can alter the local project, install software, or act on a configured remote VPS.
Mechanism
Remote model tool calls invoke local shell/file/SSH handlers.
AI rationale
The package is not malicious by source evidence, but it intentionally provides a remote-model-to-local-command bridge with broad system impact. Flag as a warning for dangerous capability rather than block it.
Evidence
package.jsonbin/ts.jslib/agent.jslib/tools.jslib/ssh.jslib/api.jslib/meta.jslib/config.js
Network endpoints1
terminalsmart.com.br
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- bin/ts.js exposes explicit `ts agente` and `ts meta` local-agent commands.
- lib/agent.js obtains a backend AI key and sends tool-enabled requests to a remote completion endpoint.
- lib/tools.js executes local shell commands and remote SSH commands selected by the agent.
- lib/meta.js can provision toolchains and run builds when explicitly invoked.
Evidence against
- package.json has no preinstall, install, postinstall, or prepare hook.
- bin/ts.js is the sole CLI entrypoint; no import-time execution found.
- Destructive shell and MCP actions require interactive or remote approval in lib/agent.js.
- Network base is package-aligned: https://terminalsmart.com.br.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
7 flaggedbin/ts.jsView file
13if (process.platform === 'win32' && process.stdout.isTTY) {
L14: try { require('child_process').execSync('chcp 65001', { stdio: 'ignore' }); } catch (_) {}
L15: }
High
11L12: // Windows legado (cmd.exe): força UTF-8 pro desenho das caixas não virar "?".
L13: if (process.platform === 'win32' && process.stdout.isTTY) {
High
4'use strict';
L5: const pkg = require('../package.json');
L6: const config = require('../lib/config');
...
L11:
L12: // Windows legado (cmd.exe): força UTF-8 pro desenho das caixas não virar "?".
L13: if (process.platform === 'win32' && process.stdout.isTTY) {
L14: try { require('child_process').execSync('chcp 65001', { stdio: 'ignore' }); } catch (_) {}
...
L84: // conveniência: tenta abrir o navegador (best-effort; TS_NO_BROWSER=1 desliga p/ cron/ssh)
L85: if (process.env.TS_NO_BROWSER !== '1') try {
L86: const { exec } = require('child_process');
...
L95: let p;
L96: try { p = await api('/api/cli/pair/poll', { method: 'POST', body: { poll: r.poll } }); } catch (_) { continue; }
Medium
Findings
5 High4 Medium6 Low
HighChild Processbin/ts.js
HighShellbin/ts.js
HighSame File Env Network Executionlib/meta.js
HighRemote Agent Bridgelib/meta.js
HighPrevious Version Dangerous Deltalib/meta.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencebin/ts.js
MediumStructural Risk Force Deep Review
LowScripts Present
LowWeak Cryptobin/ts.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to terminal-smart-cli@0.69.0.
See all versions of terminal-smart-cli for other recorded verdicts.
- Review the evidence and your use of terminal-smart-cli@0.69.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.