@openai/agents-core

The OpenAI Agents SDK is a lightweight yet powerful framework for building multi-agent workflows.

Latest 0.19.0

NPM

86%

Total Score

healthy

Active releases and organization backing support this package, despite workflow and repository-link concerns.

Are you affected? Scan for Free

Health Score Breakdown

Repo package mention

The repository name does not match the package name and its README does not mention @openai/agents-core, so the package-to-repository relationship is less transparent even though the repository is organization-owned.

Version stability

Version 0.19.0 is not a stable major version, but it is not a prerelease and recent releases contain no prerelease versions, so the main concern is API maturity rather than release instability.

Workflow audit

All eight workflows were analyzed, with no untrusted checkouts, script injection, top-level write permissions, or unpinned action references. The audit found a high-confidence template-injection issue and an informational use-trusted-publishing finding; the template issue is hygiene without a corroborating untrusted sink, while the publishing configuration warrants caution.

Vulnerabilities

Title	Versions	Severity
AIKIDO-2026-571058 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. @openai/agents-core is vulnerable to Improper Authorization in versions 0.0.7 - 0.10.0.	0.0.7 - 0.10.0	Medium
AIKIDO-2026-956109 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. @openai/agents-core is vulnerable to Path Traversal in versions 0.9.0 - 0.10.1.	0.9.0 - 0.10.1	Medium
AIKIDO-2026-152028 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. @openai/agents-core is vulnerable to Improper Authorization in versions 0.0.1 - 0.11.8.	0.0.1 - 0.11.8	Medium