@grum-os/cli@0.3.38
Keep a repository on the design contract reviewed in Grum: a local drift check, review requests, Cursor hooks and an MCP server.
AI Security Review
scanned 20d ago · by lpm-firewall-aiThe source allows an environment-provided API origin and forwards GRUM_TOKEN to it without verifying the token's intended recipient. This creates a conditional credential-exposure risk, while the inspected agent setup is explicitly prompted and does not establish a separate attack.
Static reason
One or more suspicious static signals were detected.
Trigger
Run a CLI operation that makes an authenticated project request while GRUM_TOKEN is set and GRUM_API_ORIGIN points to a different service.
Impact
The selected recipient can receive the token. This is conditional on runtime environment configuration; the source does not establish covert collection.
Mechanism
The token loader pairs GRUM_TOKEN with the selected origin, and the request helper sends it in a bearer authorization header.
AI rationale
The source allows an environment-provided API origin and forwards GRUM_TOKEN to it without verifying the token's intended recipient. This creates a conditional credential-exposure risk, while the inspected agent setup is explicitly prompted and does not establish a separate attack.
Evidence
grum.mjs
Network endpoints2
app.grum.soGRUM_API_ORIGIN-selected HTTP(S) origin
Decision evidence
public snapshotAI called this Suspicious at 84.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The indicated agent location is a local Grum Cursor rule path, and interactive setup asks before installing agent configuration.
- The API origin can be set to any HTTP(S) origin; the built-in default is Grum's app service.
- A GRUM_TOKEN environment value is paired with the selected origin without checking that the token belongs to it; saved credential files are origin-bound.
- Authenticated project lookups pass that token to a request that sends it as a bearer credential to the selected origin.
- The package exposes grum.mjs as its CLI entrypoint.
Evidence against
- The saved-session path accepts credentials only when their stored API origin matches the configured origin. The exposure therefore depends on the separate GRUM_TOKEN environment path and a caller-selected origin.
Behavioral surface
ChildProcessEnvironmentVarsNetworkWebSocket
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
8 flaggedgrum.mjsView file
139${t.fix}`:""}`}).join(`
L140: `)}function tm(e,t,n,r){let o=e?.profile,s=o?.info_cache;if(!s||typeof s!="object")return null;let i=new Set([...n,...r==="store"?[Ql]:[]]),l=Object.keys(s).sort((a,c)=>a===o?.last...
L141: `,{mode:384}),aC(n,384)}function um(e,t=or()){uC(rc(e,t),{force:!0})}function pm(e=or()){let t=ro.join(qs(e),"credentials"),n;try{n=cC(t).filter(r=>r.endsWith(".json"))}catch{retur...
High
137L138: ${Bg(n,!1,!1,s)}`}}var Yl="Grum refreshes review decisions before each MCP check or review-status lookup. If it cannot refresh, current review statuses and blocking findings are un...
L139: ${t.fix}`:""}`}).join(`
L140: `)}function tm(e,t,n,r){let o=e?.profile,s=o?.info_cache;if(!s||typeof s!="object")return null;let i=new Set([...n,...r==="store"?[Ql]:[]]),l=Object.keys(s).sort((a,c)=>a===o?.last...
L141: `,{mode:384}),aC(n,384)}function um(e,t=or()){uC(rc(e,t),{force:!0})}function pm(e=or()){let t=ro.join(qs(e),"credentials"),n;try{n=cC(t).filter(r=>r.endsWith(".json"))}catch{retur...
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
grum.mjsView on unpkg · L137137L138: ${Bg(n,!1,!1,s)}`}}var Yl="Grum refreshes review decisions before each MCP check or review-status lookup. If it cannot refresh, current review statuses and blocking findings are un...
L139: ${t.fix}`:""}`}).join(`
L140: `)}function tm(e,t,n,r){let o=e?.profile,s=o?.info_cache;if(!s||typeof s!="object")return null;let i=new Set([...n,...r==="store"?[Ql]:[]]),l=Object.keys(s).sort((a,c)=>a===o?.last...
L141: `,{mode:384}),aC(n,384)}function um(e,t=or()){uC(rc(e,t),{force:!0})}function pm(e=or()){let t=ro.join(qs(e),"credentials"),n;try{n=cC(t).filter(r=>r.endsWith(".json"))}catch{retur...
L142: `);let r=Re.join(e.repoDir,".gitignore"),o=Ns(re(r));o.changed&&dm(r,o.text)}var Ge=e=>ks($t(Re.join(e.stateDir,"contract.json"))),Sn=(e,t)=>vn(e,"contract.json",t),Kt=e=>Dg($t(Re....
L14
Findings
4 High6 Medium2 Low
HighChild Processgrum.mjs
HighSame File Env Network Executiongrum.mjs
HighCommand Output Exfiltrationgrum.mjs
HighTrigger Reachable Command Output Exfiltrationgrum.mjs
MediumNetwork
MediumEnvironment Vars
MediumAi Review Evidencegrum.mjs
MediumAi Review Evidencegrum.mjs
MediumAi Review Evidencegrum.mjs
MediumAi Review Evidencegrum.mjs
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @grum-os/cli@0.3.38.
See all versions of @grum-os/cli for other recorded verdicts.
- Review the evidence and your use of @grum-os/cli@0.3.38 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.