verify-agent-server

This fragment is a QA specification for profile and credential-management behavior, not evidence of malicious package code. It documents significant potential server risks: event-loop denial of service during profile-store lock waits, credential loss after secret-key rotation, and reference-guard bypass via .json aliases. Tests deliberately handle plaintext credentials from DEEPSEEK_API_KEY and use 127[.]0[.]0[.]1:9 as a closed endpoint; the no-cipher scenario intentionally demonstrates plaintext storage. Malware likelihood is very low, while security risk is elevated if the documented bugs exist in the implementation or if these tests run against non-isolated data.

This fragment is a security verification specification, not evidence of malware or covert exfiltration. It documents serious product risks: plaintext secrets can be exposed to authenticated callers, secret retrieval is unauthenticated when session keys are absent, and key rotation followed by writes can destroy stored credentials; clone URLs can also retain a token in local Git configuration. Severity is high for deployments using no session authentication or affected key-rotation behavior, but the fragment itself presents these as tested behaviors and known bugs. The only external hostnames shown are fixture-oriented github[.]com and gitlab[.]com, and a loopback address 127[.]0[.]0[.]1:9; no suspicious destination is indicated.

This fragment is test documentation and test code, not evidence of intentional malware; it authenticates requests to the configured server and verifies file and archive behavior. It documents security-relevant server risks: global file routes can access paths available to the server user, uploads can leave partial files, and concurrent trajectory downloads race on a shared temporary ZIP; scoped routes are tested for workspace confinement. Severity is moderate for deployments exposing the global routes, with additional reliability issues; no suspicious external domain or unauthorized data exfiltration is present.