@holostaff/cli@0.10.2
Scan your repo, map your workflows, and create workflow autopilots your users can hand a task to.
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe explicit CI simulation flow sends target-app passwords from environment variables in the model prompt to a separate model endpoint. This is credential disclosure to a host unrelated to the account’s service, without evidence of consent to that disclosure.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A user runs `holostaff simulate --ci` with the simulation account email and password configured.
Impact
The target-app username and password are disclosed to the model endpoint, which may be OpenAI or Holostaff’s proxy.
Mechanism
The runner copies the environment credentials into scenario data; the engine inserts them into its model briefing and sends that prompt to an OpenAI-compatible endpoint.
Attack narrative
When `simulate --ci` runs with account credentials configured, the runner copies them into each scenario. The simulation engine embeds the login and password in the model’s system prompt and sends that prompt to an OpenAI-compatible endpoint, defaulting to api.openai.com or using Holostaff’s proxy. The package does not establish that these target-app credentials are restricted from the model provider.
AI rationale
The explicit CI simulation flow sends target-app passwords from environment variables in the model prompt to a separate model endpoint. This is credential disclosure to a host unrelated to the account’s service, without evidence of consent to that disclosure.
Evidence
dist/commands/simulateCi.jsdist/commands/simulateCiRunner.jsdist/engine/run.js
Network endpoints2
api.openai.comholostaff-vision-1008066443043.us-central1.run.app
Decision evidence
public snapshotAI called this Malicious at 92.0% confidence as Malware with low false-positive risk.
Evidence for block
- The CI simulation runner is reached when the user invokes `simulate --ci`.
- The runner reads the app login email and password from `HOLOSTAFF_SIM_ACCOUNT_EMAIL` and `HOLOSTAFF_SIM_ACCOUNT_PASSWORD`, then includes them in scenario data.
- The engine places those credentials in the model briefing and sends its messages to an OpenAI-compatible chat endpoint.
- The endpoint defaults to `https://api.openai.com`; without a job-provided OpenAI key, the runner routes model access through the Holostaff API proxy.
Evidence against
- The credential flow is triggered by an explicit simulation command, and the credentials are supplied through dedicated environment variables for that simulation.
- The runner’s result and recording uploads to Holostaff are part of its stated CI-results workflow.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
6 flaggeddist/instrument/openPullRequest.jsView file
18*/
L19: import { execFile } from 'node:child_process';
L20: import { promisify } from 'node:util';
High
Child Process
Package source references child process execution.
dist/instrument/openPullRequest.jsView on unpkg · L18dist/deploy/editsKey.jsView file
1/**
L2: * Stable SHA-1 hash of customerEdits — pair for the server's
Low
Weak Crypto
Package source references weak cryptographic algorithms.
dist/deploy/editsKey.jsView on unpkg · L1dist/commands/simulateCiRunner.jsView file
•
Findings
1 Critical4 High2 Medium5 Low
CriticalPrevious Version Dangerous Deltadist/commands/simulateCiRunner.js
HighChild Processdist/instrument/openPullRequest.js
HighCommand Output Exfiltrationdist/commands/simulateCiRunner.js
HighTrigger Reachable Command Output Exfiltrationdist/commands/simulateCiRunner.js
HighSemantic Analysis Limiteddist/engine/run.js#virtual:normalized:round1
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowWeak Cryptodist/deploy/editsKey.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @holostaff/cli@0.10.2.
See all versions of @holostaff/cli for other recorded verdicts.
- Avoid installing @holostaff/cli@0.10.2. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.