@agent-native/core

AI Security Review

Evidence context: threat category none; evidence quality moderate.

What this package is

@agent-native/core is described as an agentic application framework for building autonomous agents with UIs. Its published contents include a large bundled codebase: compiled output under dist/, example applications under corpus/templates, and agent engines such as dist/agent/engine/chatgpt-subscription-engine.js. The scan is dominated by volume, not by behavior.

Tool poisoning

No tool-poisoning patterns matched. That is the most important result here, because a poisoned MCP server hides directives aimed at the AI inside tool descriptions or tool names. Nothing in this package does that: no <IMPORTANT> blocks, no hidden Unicode instructions, no directives telling the agent to stay quiet or to run something silently. The tool registration this framework ships is the ordinary kind that defines or orchestrates tools for the developer, not the kind that manipulates the model.

Credential and network access

The only critical-severity entries are hardcoded token strings reported under the title MCP-TRANSPORT-HARDCODED-TOKEN. They appear in files that exist to run demos and tests: dist/shared/auth-copy.js, corpus/templates/content/scripts/seed-demo-user.mjs, corpus/templates/design/e2e/global-setup.ts, and the en-US.ts locale files under corpus/templates/clips and corpus/templates/plan. A file called auth-copy.js sitting next to a seed-demo-user script and an e2e global-setup is the shape of placeholder credentials used to make examples and test suites run, not live secrets. Nothing in the set reads .ssh, .aws/credentials, .kube/config, or application_default_credentials.json, and nothing pairs a credential read with a send to an unrelated host. There is no harvest-then-exfiltrate pipeline.

The network findings come from bundled JavaScript. The endpoint list is mostly extractor noise: strings such as accessibility.focused.as, account.domains, 3dicons.co and active.is are property-access chains and short domain fragments pulled out of minified code, mixed with documentation filenames like 05-tools-sandbox.md and 01-assessment.md. None of them is a known exfiltration host, and no finding shows a credential being posted anywhere.

Strongest counterargument

The strongest case against calling this a false positive is sheer scale: over 23,000 findings and 29 of them critical. That is the wrong lens. The 19,459 code-smell hits are generic YARA postinstall and credential patterns that fire on any non-trivial Node.js bundle, and the critical secrets sit in demo and test scaffolding. A shipped live credential would show up beside a fetch to an unrelated domain; here the network entries point at framework and documentation strings. The volume reflects the size of the bundled corpus, not malicious intent.

Key Reasons

• Zero tool-poisoning findings; no hidden directives in tool names or descriptions
• Critical MCP-TRANSPORT-HARDCODED-TOKEN hits all sit in demo/test fixtures (dist/shared/auth-copy.js, seed-demo-user.mjs, e2e/global-setup.ts, i18n en-US.ts)
• No credential paths (.ssh, .aws, .kube, application_default_credentials.json) read anywhere in the scan
• network_endpoints list is IoC extractor noise: property chains like accessibility.focused.as and markdown filenames like 05-tools-sandbox.md
• 19,459 code-smell hits and zero malware-signature, zero malware, zero dependency findings, consistent with bundled library code

False Positive Considerations

• Hardcoded-token findings land in demo and test scaffolding rather than auth flows
• 18k+ code-smell hits are generic YARA rules that match any Node.js bundle
• network_endpoints list is populated by IoC extractor artifacts (property-access chains, markdown filenames)
• Zero tool-poisoning and zero malware-signature categories

Reviewed 2026-09-30; recommended action: no action; model confidence 72%.