io.github.asklokesh/loki-mode

What we checked

Six static checks, weighted by risk. Every result reflects only what could be observed in the published package and repository — never intent.

• Injection surface

  unscannable25% of grade

  Tool descriptions/manifest scanned for instruction-injection patterns (imperatives at the model, hidden text, 'ignore previous', data-exfil URLs).

  No tool descriptions, server instructions, prompts, or resources were fetched; nothing to scan for injection.

• Supply chain

  pass25% of grade

  Package provenance: namespace verification, repo linkage, maintainer count, account age, postinstall scripts, typosquat distance.

  repository linkage verified

• Credential hygiene

  warn15% of grade

  How the server takes secrets (env vs plaintext config vs hardcoded); secrets appearing in tool schemas.

  bin/postinstall.js: assigns a literal to api_key (phc_…87 (len 47)) — non-provider secret literal; prefer environment intake. autonomy/issue-providers.sh: assigns a literal to token (${JI…}} (len 34)) — non-provider secret literal; prefer environment intake. Reads secrets from the environment (e.g. src/integrations/slack/adapter.js) — the recommended intake shape.

• Permission scope

  fail15% of grade

  Declared tools vs. breadth (filesystem, network, exec); flags shell-exec and unbounded filesystem access.

  HIGH: memory/ingest.py: references a sensitive credential path (.aws/credentials) — the tool-poisoning exfiltration target. HIGH: providers/claude.sh: references a sensitive credential path (/mcp.json) — the tool-poisoning exfiltration target. HIGH: autonomy/lib/mcp-config.sh: references a sensitive credential path (/mcp.json) — the tool-poisoning exfiltration target. HIGH: autonomy/sandbox.sh: references a sensitive credential path (/.ssh/) — the tool-poisoning exfiltration target. HIGH: shell/exec capability AND network egress together — download-and-execute risk (autonomy/api-server.js: imports child_process and calls exec/spawn; src/integrations/linear/client.js: outbound HTTP/socket call). HIGH: shell/exec capability AND destructive filesystem writes together (autonomy/api-server.js: imports child_process and calls exec/spawn; src/integrations/slack/adapter.js: path traversal ('../') combined with file access). discloses shell/exec capability: autonomy/api-server.js: imports child_process and calls exec/spawn discloses shell/exec capability: src/plugins/gate-plugin.js: imports child_process and calls exec/spawn discloses shell/exec capability: bin/loki-mode.js: imports child_process and calls exec/spawn discloses shell/exec capability: src/protocols/mcp-client.js: imports child_process and calls exec/spawn discloses shell/exec capability: src/plugins/mcp-plugin.js: imports child_process and calls exec/spawn discloses shell/exec capability: bin/postinstall.js: imports child_process and calls exec/spawn discloses shell/exec capability: api/server.js: imports child_process and calls exec/spawn discloses shell/exec capability: api/test.js: imports child_process and calls exec/spawn discloses shell/exec capability: autonomy/checklist-verify.py: subprocess.* call discloses shell/exec capability: dashboard/control.py: subprocess.* call discloses shell/exec capability: autonomy/lib/crash_capture.py: subprocess.* call discloses shell/exec capability: magic/core/debate.py: subprocess.* call discloses shell/exec capability: magic/core/generator.py: subprocess.* call discloses shell/exec capability: agents/hub_install.py: subprocess.* call discloses shell/exec capability: tools/hybrid_search.py: subprocess.* call discloses shell/exec capability: mcp/lsp_proxy.py: subprocess.* call discloses shell/exec capability: mcp/magic_tools.py: subprocess.* call discloses shell/exec capability: dashboard/migration_engine.py: subprocess.* call discloses shell/exec capability: autonomy/mirofish-adapter.py: subprocess.* call discloses shell/exec capability: memory/namespace.py: subprocess.* call discloses shell/exec capability: autonomy/lib/proof-generator.py: subprocess.* call discloses shell/exec capability: memory/replay.py: subprocess.* call discloses shell/exec capability: dashboard/rigour_integration.py: subprocess.* call discloses shell/exec capability: dashboard/server.py: subprocess.* call discloses shell/exec capability: mcp/server.py: subprocess.* call discloses shell/exec capability: web-app/server.py: subprocess.* call with shell=True (command-injection prone) discloses shell/exec capability: autonomy/trigger-schedule.py: subprocess.* call discloses shell/exec capability: autonomy/trigger-server.py: subprocess.* call discloses shell/exec capability: autonomy/lib/wiki_index.py: subprocess.* call discloses shell/exec capability: autonomy/lib/wiki_llm.py: subprocess.* call discloses shell/exec capability: autonomy/provider-offer.sh: imports child_process discloses dynamic code execution: dashboard/server.py: uses eval/exec/__import__ discloses broad/destructive filesystem access: src/integrations/slack/adapter.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: src/integrations/teams/adapter.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: autonomy/api-server.js: destructive/writing fs.* call (write/unlink/rm/chmod/rename) discloses broad/destructive filesystem access: src/policies/approval.js: destructive/writing fs.* call (write/unlink/rm/chmod/rename) discloses broad/destructive filesystem access: src/protocols/tools/checkpoint-restore.js: destructive/writing fs.* call (write/unlink/rm/chmod/rename) discloses broad/destructive filesystem access: src/policies/cost.js: destructive/writing fs.* call (write/unlink/rm/chmod/rename) discloses broad/destructive filesystem access: bin/postinstall.js: destructive/writing fs.* call (write/unlink/rm/chmod/rename) discloses broad/destructive filesystem access: src/protocols/tools/start-project.js: destructive/writing fs.* call (write/unlink/rm/chmod/rename) discloses broad/destructive filesystem access: src/integrations/linear/sync.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: api/test.js: destructive/writing fs.* call (write/unlink/rm/chmod/rename) discloses broad/destructive filesystem access: api/test.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: src/policies/types.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: learning/aggregator.py: open(…, 'w'/'a'/'x') write-mode file access discloses broad/destructive filesystem access: learning/aggregator.py: path traversal ('../') combined with file access discloses broad/destructive filesystem access: dashboard/api_v2.py: open(…, 'w'/'a'/'x') write-mode file access discloses broad/destructive filesystem access: autonomy/lib/assets_bundle.py: path traversal ('../') combined with file access discloses broad/destructive filesystem access: dashboard/audit.py: open(…, 'w'/'a'/'x') write-mode file access discloses broad/destructive filesystem access: dashboard/auth.py: open(…, 'w'/'a'/'x') write-mode file access discloses broad/destructive filesystem access: dashboard/auth.py: destructive filesystem call (shutil.rmtree/os.remove/etc.) discloses broad/destructive filesystem access: tools/bench_cross_project_lift.py: open(…, 'w'/'a'/'x') write-mode file access discloses broad/destructive filesystem access: tools/bench_cross_project_lift.py: destructive filesystem call (shutil.rmtree/os.remove/etc.) discloses broad/destructive filesystem access: tools/bench_memory_retrieval.py: destructive filesystem call (shutil.rmtree/os.remove/etc.) discloses broad/destructive filesystem access: autonomy/bmad-adapter.py: destructive filesystem call (shutil.rmtree/os.remove/etc.) discloses broad/destructive filesystem access: events/bus.py: open(…, 'w'/'a'/'x') write-mode file access discloses broad/destructive filesystem access: autonomy/checklist-verify.py: destructive filesystem call (shutil.rmtree/os.remove/etc.) discloses broad/destructive filesystem access: memory/consolidation.py: open(…, 'w'/'a'/'x') write-mode file access discloses broad/destructive filesystem access: dashboard/control.py: open(…, 'w'/'a'/'x') write-mode file access discloses broad/destructive filesystem access: dashboard/control.py: destructive filesystem call (shutil.rmtree/os.remove/etc.) discloses broad/destructive filesystem access: autonomy/lib/crash_capture.py: open(…, 'w'/'a'/'x') write-mode file access discloses broad/destructive filesystem access: autonomy/lib/crash_capture.py: path traversal ('../') combined with file access discloses broad/destructive filesystem access: memory/cross_project.py: open(…, 'w'/'a'/'x') write-mode file access discloses broad/destructive filesystem access: magic/core/debate.py: path traversal ('../') combined with file access discloses broad/destructive filesystem access: memory/embeddings.py: open(…, 'w'/'a'/'x') write-mode file access discloses broad/destructive filesystem access: learning/emitter.py: open(…, 'w'/'a'/'x') write-mode file access discloses broad/destructive filesystem access: magic/core/generator.py: path traversal ('../') combined with file access discloses broad/destructive filesystem access: agents/hub_install.py: destructive filesystem call (shutil.rmtree/os.remove/etc.) discloses broad/destructive filesystem access: memory/layers/index_layer.py: destructive filesystem call (shutil.rmtree/os.remove/etc.) discloses broad/destructive filesystem access: memory/knowledge_graph.py: open(…, 'w'/'a'/'x') write-mode file access discloses broad/destructive filesystem access: agents/managed_registry.py: destructive filesystem call (shutil.rmtree/os.remove/etc.) discloses broad/destructive filesystem access: state/manager.py: open(…, 'w'/'a'/'x') write-mode file access discloses broad/destructive filesystem access: state/manager.py: destructive filesystem call (shutil.rmtree/os.remove/etc.) discloses broad/destructive filesystem access: dashboard/migration_engine.py: destructive filesystem call (shutil.rmtree/os.remove/etc.) discloses broad/destructive filesystem access: autonomy/mirofish-adapter.py: destructive filesystem call (shutil.rmtree/os.remove/etc.) discloses broad/destructive filesystem access: memory/namespace.py: open(…, 'w'/'a'/'x') write-mode file access discloses broad/destructive filesystem access: memory/namespace.py: destructive filesystem call (shutil.rmtree/os.remove/etc.) discloses broad/destructive filesystem access: autonomy/openspec-adapter.py: destructive filesystem call (shutil.rmtree/os.remove/etc.) discloses broad/destructive filesystem access: autonomy/prd-analyzer.py: destructive filesystem call (shutil.rmtree/os.remove/etc.) discloses broad/destructive filesystem access: dashboard/prompt_optimizer.py: destructive filesystem call (shutil.rmtree/os.remove/etc.) discloses broad/destructive filesystem access: autonomy/lib/proof-generator.py: open(…, 'w'/'a'/'x') write-mode file access discloses broad/destructive filesystem access: dashboard/registry.py: open(…, 'w'/'a'/'x') write-mode file access discloses broad/destructive filesystem access: memory/managed_memory/retrieve.py: destructive filesystem call (shutil.rmtree/os.remove/etc.) discloses broad/destructive filesystem access: dashboard/rigour_integration.py: open(…, 'w'/'a'/'x') write-mode file access discloses broad/destructive filesystem access: dashboard/server.py: destructive filesystem call (shutil.rmtree/os.remove/etc.) discloses broad/destructive filesystem access: mcp/server.py: path traversal ('../') combined with file access discloses broad/destructive filesystem access: web-app/server.py: open(…, 'w'/'a'/'x') write-mode file access discloses broad/destructive filesystem access: web-app/server.py: destructive filesystem call (shutil.rmtree/os.remove/etc.) discloses broad/destructive filesystem access: web-app/server.py: path traversal ('../') combined with file access discloses broad/destructive filesystem access: state/sqlite_backend.py: destructive filesystem call (shutil.rmtree/os.remove/etc.) discloses broad/destructive filesystem access: memory/storage.py: open(…, 'w'/'a'/'x') write-mode file access discloses broad/destructive filesystem access: memory/storage.py: destructive filesystem call (shutil.rmtree/os.remove/etc.) discloses broad/destructive filesystem access: memory/tests/test_app_graph.py: destructive filesystem call (shutil.rmtree/os.remove/etc.) discloses broad/destructive filesystem access: memory/test_importance.py: destructive filesystem call (shutil.rmtree/os.remove/etc.) discloses broad/destructive filesystem access: state/test_manager.py: open(…, 'w'/'a'/'x') write-mode file access discloses broad/destructive filesystem access: memory/tests/test_namespace.py: open(…, 'w'/'a'/'x') write-mode file access discloses broad/destructive filesystem access: memory/tests/test_namespace.py: destructive filesystem call (shutil.rmtree/os.remove/etc.) discloses broad/destructive filesystem access: memory/layers/timeline_layer.py: destructive filesystem call (shutil.rmtree/os.remove/etc.) discloses broad/destructive filesystem access: memory/token_economics.py: destructive filesystem call (shutil.rmtree/os.remove/etc.) discloses broad/destructive filesystem access: mcp/tools.py: open(…, 'w'/'a'/'x') write-mode file access discloses broad/destructive filesystem access: autonomy/trigger-schedule.py: open(…, 'w'/'a'/'x') write-mode file access discloses broad/destructive filesystem access: autonomy/trigger-server.py: open(…, 'w'/'a'/'x') write-mode file access discloses broad/destructive filesystem access: memory/vector_index.py: destructive filesystem call (shutil.rmtree/os.remove/etc.) discloses broad/destructive filesystem access: providers/claude.sh: path traversal ('../') combined with file access discloses broad/destructive filesystem access: autonomy/completion-council.sh: open(…, 'w'/'a'/'x') write-mode file access discloses broad/destructive filesystem access: autonomy/council-v2.sh: path traversal ('../') combined with file access discloses broad/destructive filesystem access: autonomy/lib/mcp-config.sh: open(…, 'w'/'a'/'x') write-mode file access discloses broad/destructive filesystem access: autonomy/mcp-launch.sh: path traversal ('../') combined with file access discloses broad/destructive filesystem access: autonomy/hooks/migration-hooks.sh: open(…, 'w'/'a'/'x') write-mode file access discloses broad/destructive filesystem access: autonomy/playwright-verify.sh: destructive/writing fs.* call (write/unlink/rm/chmod/rename) discloses broad/destructive filesystem access: autonomy/prd-checklist.sh: open(…, 'w'/'a'/'x') write-mode file access discloses broad/destructive filesystem access: autonomy/quickstart.sh: path traversal ('../') combined with file access discloses broad/destructive filesystem access: autonomy/sandbox.sh: open(…, 'w'/'a'/'x') write-mode file access discloses broad/destructive filesystem access: autonomy/spec.sh: path traversal ('../') combined with file access discloses broad/destructive filesystem access: autonomy/verify.sh: open(…, 'w'/'a'/'x') write-mode file access discloses broad/destructive filesystem access: autonomy/verify.sh: path traversal ('../') combined with file access discloses broad/destructive filesystem access: autonomy/lib/voter-agents.sh: open(…, 'w'/'a'/'x') write-mode file access discloses broad/destructive filesystem access: autonomy/lib/voter-agents.sh: path traversal ('../') combined with file access discloses broad/destructive filesystem access: events/bus.ts: destructive/writing fs.* call (write/unlink/rm/chmod/rename) discloses broad/destructive filesystem access: api/services/cli-bridge.ts: path traversal ('../') combined with file access discloses broad/destructive filesystem access: api/middleware/error.ts: path traversal ('../') combined with file access discloses broad/destructive filesystem access: state/manager.ts: destructive/writing fs.* call (write/unlink/rm/chmod/rename) discloses broad/destructive filesystem access: state/manager.ts: path traversal ('../') combined with file access discloses broad/destructive filesystem access: api/routes/memory.ts: path traversal ('../') combined with file access discloses broad/destructive filesystem access: learning/signals.ts: destructive/writing fs.* call (write/unlink/rm/chmod/rename) discloses broad/destructive filesystem access: api/services/state-notifications.ts: path traversal ('../') combined with file access discloses broad/destructive filesystem access: api/services/state-watcher.ts: path traversal ('../') combined with file access discloses broad/destructive filesystem access: state/test_manager.ts: destructive/writing fs.* call (write/unlink/rm/chmod/rename) Capability DISCLOSURE, not a verdict: static analysis sees the primitive is present and reachable, not whether its use is attacker-controlled.

• Version behavior

  unscannable10% of grade

  Diff of tool definitions between versions; new permissions or changed descriptions in a patch release (the postmark-mcp class).

  no prior version to diff (first sight of io.github.asklokesh/[email protected]); version-drift / rug-pull cannot be evaluated. Cold-start risk is covered by point-in-time checks (injection_surface, supply_chain, credential_hygiene), not here.

• Transport config

  warn10% of grade

  Remote servers: TLS and auth mode (none/token/OAuth). Local servers: whether the manifest indicates it phones home.

  sends telemetry to third-party SDK (PostHog) — disclosure, verify opt-in; manifest/source references telemetry behavior — disclosure