registry / @holostaff/cli / 0.10.3
@holostaff/cli@0.10.3
Scan your repo, map your workflows, and create workflow autopilots your users can hand a task to.
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe flagged command requires an explicit simulation invocation and uses credentials with the intended Holostaff or configured model service. Its process execution and result uploads support the package’s simulation purpose, with no reviewed evidence of unrelated data collection or transmission.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Explicit invocation of `holostaff simulate --ci`.
Impact
Simulation results and recordings may be sent to Holostaff; model prompts and responses go to the configured model endpoint. The reviewed code does not show unrelated credential collection or transmission.
Mechanism
The runner authenticates to the configured Holostaff API, launches the repository’s configured service and simulation engine, calls the configured model endpoint, and uploads simulation results.
AI rationale
The flagged command requires an explicit simulation invocation and uses credentials with the intended Holostaff or configured model service. Its process execution and result uploads support the package’s simulation purpose, with no reviewed evidence of unrelated data collection or transmission.
Evidence
.holostaff/sim-runsOS temporary directory containing `holostaff-sim-<timestamp>`The report output path supplied by the user
Network endpoints2
holostaff-vision-1008066443043.us-central1.run.app (default; configurable with HOLOSTAFF_API_BASE_URL)api.openai.com (default model endpoint; configurable with SIM_MODEL_BASE_URL)
Decision evidence
public snapshotAI called this Clean at 93.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package exposes `dist/index.js` as its CLI entry point.
- The simulation runner is reached through the explicit `holostaff simulate` command and uses its CI mode only when `--ci` is set.
- CI simulation requires a Holostaff API key and sends it to the configured API base, which defaults to Holostaff’s service.
- The engine sends model requests to the configured OpenAI-compatible endpoint, defaulting to `api.openai.com`, using the configured model key.
- The runner uploads simulation results to the Holostaff API as part of the requested simulation workflow.
Evidence against
- CI simulation can execute service commands from the repository’s `.holostaff/environment.json` recipe and access configured CI credentials; these actions occur as part of the explicitly invoked simulation feature.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStrings
Source & flagged code
6 flaggeddist/instrument/openPullRequest.jsView file
18*/
L19: import { execFile } from 'node:child_process';
L20: import { promisify } from 'node:util';
High
Child Process
Package source references child process execution.
dist/instrument/openPullRequest.jsView on unpkg · L18dist/deploy/editsKey.jsView file
1/**
L2: * Stable SHA-1 hash of customerEdits — pair for the server's
Low
Weak Crypto
Package source references weak cryptographic algorithms.
dist/deploy/editsKey.jsView on unpkg · L1dist/commands/simulateCiRunner.jsView file
•
Findings
1 Critical5 High2 Medium5 Low
CriticalPrevious Version Dangerous Deltadist/commands/simulateCiRunner.js
HighChild Processdist/instrument/openPullRequest.js
HighShell
HighCommand Output Exfiltrationdist/commands/simulateCiRunner.js
HighTrigger Reachable Command Output Exfiltrationdist/commands/simulateCiRunner.js
HighSemantic Analysis Limiteddist/engine/run.js#virtual:normalized:round1
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowWeak Cryptodist/deploy/editsKey.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @holostaff/cli@0.10.3.
See all versions of @holostaff/cli for other recorded verdicts.
- Review the evidence and your use of @holostaff/cli@0.10.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.