Is relay-companion safe?
- Node.js shell/command execution
- Defense-evasion command idiom
- Node.js filesystem read
relay-companion is an AI npm_package analyzed by SkillTotal's deterministic static scanner. The scan found no malicious indicators, though 7 risky constructs are reported for review. It can: delegated authentication, filesystem read, filesystem write, mcp tools detected, network egress and shell execution — capabilities are what the code can do, not a verdict on intent. Risk score 20/100 (low).
relay-companion 0.1.440
Automated static-analysis result. It can contain false positives and false negatives, and is not a claim about the intent of relay-companion's authors. Report a false positive.
Behavioral traits
How this component maps to the CSA agentic threat model. Descriptive — it never affects the risk score.
Findings (7)
A command uses a known defense-evasion idiom: PowerShell execution-policy bypass / encoded command / hidden window, macOS code-signing bypass, or launching a payload from a world-writable temp directory. These are hallmarks of droppers and rarely appear in legitimate code. (3 occurrence(s) shown as evidence).
"-NoProfile", "-NonInteractive", "-ExecutionPolicy", "Bypass", "-EncodedCommand", encoded,
const signed = runCommand("/usr/bin/codesign", ["--force", "--deep", "--sign", "-", tmpPath]);Fix: Verify why the component bypasses execution policy / code signing or runs from a temp directory; these patterns are characteristic of malware staging.
The component can run operating-system commands or spawn processes.
import { spawnSync, spawn } from "node:child_process";const result = spawnSync(command, args, { stdio: "ignore" });const beforePidResult = spawnSync("systemctl", ["--user", "show", "--property=MainPID", "--value", "work.relay.companion.pill.service"], {const mainPid = spawnSync("systemctl", ["--user", "show", "--property=MainPID", "--value", "work.relay.companion.pill.service"], {const child = spawn(
const du = spawnSync("du", ["-sk", layout.releasesDir], { encoding: "utf8", timeout: 30_000 });const probe = spawnSync(
const mime = spawnSync("xdg-mime", ["query", "default", "x-scheme-handler/relay"], {spawnSync("launchctl", ["kickstart", "-k", `gui/${uid}/work.relay.companion.pill`], { stdio: "ignore" });const result = spawnSync(process.execPath, [bootstrap, "setup", ...rest], {const { spawnSync } = require("node:child_process");const { spawnSync } = require("node:child_process");const names = spawnSync(nameInvocation.command, nameInvocation.args, { cwd: nameInvocation.cwd, encoding: "utf8", windowsHide: true });const details = spawnSync(detailInvocation.command, detailInvocation.args, { cwd: detailInvocation.cwd, encoding: "utf8", windowsHide: true });const { spawnSync } = require("node:child_process");const result = spawnSync(String(current.node), [bin, ...process.argv.slice(2)], { stdio: "inherit", env: process.env, windowsHide: true });const unpack = spawnSync(unpackInvocation.command, unpackInvocation.args, {const { spawnSync } = require("node:child_process");return spawnSync(command, args, { encoding: "utf8", timeout: 30_000, windowsHide: true, ...options });const { spawn } = require("node:child_process");const cp = require("node:child_process");const child = spawn(
const child = spawn(
const child = spawn(
const child = spawn(cmd, args, { detached: true, stdio: "ignore" });Why it matters: Powerful and often legitimate — confirm the commands aren't built from untrusted input.
Fix: Confirm the command and its arguments are fully controlled and not derived from untrusted input; prefer execFile with an argument array.
The component reads files from disk.
const input = fs.createReadStream(file);
try { document = JSON.parse(fs.readFileSync(mapPath, "utf8")); } catch {const manifest = JSON.parse(fs.readFileSync(path.join(packageRoot, "package.json"), "utf8"));
try { current = JSON.parse(fs.readFileSync(pointerPath, "utf8")); }const existingLauncher = fs.existsSync(launcherPath) ? fs.readFileSync(launcherPath, "utf8") : null;
const existingShim = fs.existsSync(shimPath) ? fs.readFileSync(shimPath, "utf8") : null;
overlayPrefs = JSON.parse(fs.readFileSync(OVERLAY_PREFS_PATH, "utf8")) || {};raw = fs.readFileSync(configPath, "utf8");
const ledger = JSON.parse(fs.readFileSync(ledgerPath, "utf8")) || {};raw = JSON.parse(fs.readFileSync(STATE_PATH, "utf8")) || {};const store = JSON.parse(fs.readFileSync(STATE_PATH, "utf8")) || {};return Number(JSON.parse(fs.readFileSync(metaPath, "utf8")).lastFocusedAt) || 0;
settings = JSON.parse(fs.readFileSync(install.claudeSettingsPath(), "utf8")) || {};targetCliPid = Number(JSON.parse(fs.readFileSync(rendezvousPath, "utf8")).cliPid) || 0;
const published = JSON.parse(fs.readFileSync(directory.sessionDirectoryStatePath(), "utf8"));
const raw = fs.readFileSync(SCHEDULES_PATH, "utf8");
const b = fs.readFileSync(file);
const serialized = fs.readFileSync(statePath, "utf8");
const value = JSON.parse(fs.readFileSync(file, "utf8"));
try { meta = JSON.parse(fs.readFileSync(metaPath, "utf8")); } catch {}const body = await fs.readFile(filePath);
const pkg = JSON.parse(fs.readFileSync(path.join(packageRoot, "package.json"), "utf8"));
const value = JSON.parse(fs.readFileSync(file, "utf8"));
const row = JSON.parse(fs.readFileSync(path.join(channelPresenceDir(homeDir), name), "utf8"));
const row = JSON.parse(fs.readFileSync(path.join(channelPresenceDir(homeDir), name), "utf8"));
Why it matters: Usually legitimate, but worth confirming it can't be steered into reading sensitive files.
Fix: Confirm which files are read and that paths cannot be influenced by untrusted input to reach sensitive locations.
The component writes or deletes files on disk.
const output = fs.createWriteStream(file, { flags: "r+", start: offset, mode: 0o600 });fs.rmSync(file, { force: true });fs.writeFileSync(temporary, `${JSON.stringify(value, null, 2)}\n`, { mode: 0o600 });fs.writeFileSync(temporary, value, { mode, flag: "wx" });try { fs.rmSync(temporary, { force: true }); } catch {}removePointer = (file) => fs.rmSync(file, { force: true }),try { fs.rmSync(failedRoot, { recursive: true, force: true }); } catch {}fs.rmSync(staging, { recursive: true, force: true });fs.writeFileSync(ledgerPath, `${JSON.stringify(ledger, null, 2)}\n`);fs.rmSync(claimed, { force: true });fs.rmSync(eventFile, { force: true });fs.writeFileSync(target, Buffer.from(encoded, "base64"), { mode: 0o600 });try { fs.rmSync(tempDir, { recursive: true, force: true }); } catch {}fs.writeFileSync(path.join(noteDir, `${safeNoteStem(id)}.md`), note);fs.writeFileSync(storedPath, bytes, { mode: 0o600 });fs.writeFileSync(imagePath, bytes, { mode: 0o600 });fs.writeFileSync(path.join(noteDir, `${safeNoteStem(id)}.md`), composerNote);fs.writeFileSync(SCHEDULES_PATH, JSON.stringify(all, null, 2));
fs.appendFileSync(PERF_LOG_PATH, `${line}\n`);fs.appendFileSync(
fs.writeFileSync(tmp, `${JSON.stringify(value, null, 2)}\n`, { mode: 0o600 });try { fs.unlinkSync(file); } catch {}fs.writeFileSync(file, `${JSON.stringify(value)}\n`);fs.appendFileSync(logPath, `[relay-update] ${new Date().toISOString()} ${message}\n`);fs.writeFileSync(
Why it matters: Usually legitimate, but worth confirming the paths can't be controlled by untrusted input.
Fix: Confirm which files are written/deleted and that paths cannot be influenced by untrusted input.
The component makes outbound network requests.
const https = require("node:https");const request = https.get(parsed, { headers: { "user-agent": `${PACKAGE_NAME}/${packageJson.version}` } }, (response) => {res = await fetch(upload.url, { method: "POST", body: form });res = await fetch(upload.url, {return { dispatcher: null, fetch: (u, i) => fetch(u, i) };return transport.fetch(url, transport.dispatcher ? { ...init, dispatcher: transport.dispatcher } : init);import http from "node:http";
const req = http.get({ host: INSPECTOR_HOST, port, path: "/json/list", timeout: 300 }, (res) => {const response = await fetch(attachment.downloadUrl, { signal: AbortSignal.timeout(30_000) });import { createServer as createHttpServer } from "node:http";import { createServer as createHttpsServer } from "node:https";const res = await fetch(url, { signal: AbortSignal.timeout(30000) });Why it matters: Usually legitimate, but confirm the destinations are expected and no sensitive data leaves.
Fix: Confirm the destination hosts are expected and that no sensitive data is sent off-host.
An OAuth 2.0 / OpenID Connect delegated-authentication flow was detected (authorization-code / refresh-token / token-exchange grant, an OIDC authorize/discovery endpoint or id_token, or a delegation library). Tools authenticate with the end user's delegated, scoped credentials rather than a long-lived embedded service credential. (5 occurrence(s) shown as evidence).
authorization_endpoint: `${origin}/oauth/authorize`,if (req.method === "GET" && pathname === "/oauth/authorize") {html(res, 200, `<!doctype html><html lang="en"><meta charset="utf-8"><meta name="viewport" content="width=device-width"><title>Connect Claude to Relay</title><style>body{font:16px system-ui;max-width:32rem;margin:4rem auto;padding:1rem;line …if (req.method === "POST" && pathname === "/oauth/authorize") {if (provider === "claude" && parsed.hostname === "claude.com" && parsed.pathname === "/cai/oauth/authorize") {Fix: Delegated auth is a lower-blast-radius execution context than an embedded static credential. Confirm the requested scopes are minimal and that tokens are never logged or forwarded off-host.
An MCP tool surface (manifest or tool definitions) was found.
const server = new Server(
const server = new Server(
const server = new Server(
Why it matters: Just context — review which tools it offers and their permissions.
Fix: Review the declared MCP tools and their permissions.
Check your own component
Run the same evidence-backed scan on any MCP server, agent skill, or package.
Scan your own componentHow we determine this: deterministic static analysis (regex + AST), evidence-anchored, no code execution. Methodology →