Local-first, agent-friendly Markdown knowledge base with a cross-platform CLI and web editor
AI Security Review
scanned 8d ago · by lpm-firewall-ai
The manifest has no install lifecycle hook, and inspected agent-related code does not establish an attack. The package loads platform-specific native modules whose behavior remains unresolved, so a clean verdict is not supported.
Unknown; no malicious trigger was established from the inspected source.
Impact
The unresolved native behavior prevents a source-grounded clean determination.
Mechanism
Platform-specific native modules are loaded by the package's native binding loader.
AI rationale
The manifest has no install lifecycle hook, and inspected agent-related code does not establish an attack. The package loads platform-specific native modules whose behavior remains unresolved, so a clean verdict is not supported.
Decision evidence
public snapshot
AI called this Manual Review at 84.0% confidence as Unknown with medium false-positive risk.
AI review observations
The manifest exports a runtime module and CLI, and its scripts list build and verification tasks rather than install hooks.
The runtime maps supported editors to skill directories; the CLI removal planner includes project-scoped cleanup paths.
The package includes a native loader that can load platform-specific native bindings, whose behavior could not be resolved from the available source inspection.
Evidence against
The inspected manifest contains no preinstall, install, or postinstall script.
The inspected agent-related paths describe editor skill locations, configuration paths, and cleanup behavior; they do not establish an attack.
1import{o as e}from"./rolldown-runtime-tZXQYakl.mjs";import{Cf as t,Ef as n,Fl as r,G as i,Il as a,Jc as o,Ju as s,Of as c,Tf as l,U as u,W as d,Wc as f,Yc as p,ba as m,bf as h,hf a...
L2: `)[0]??``).replace(/\S*\/journal\/\S*/g,`<journal path>`).replace(/\b[0-9a-f]{32}\b/gi,`<id>`);return`exit ${e.status}${t===``?``:`: ${t}`}`}function J(e,t,n){return{schemaVersion:...
1import{o as e}from"./rolldown-runtime-tZXQYakl.mjs";import{Cf as t,Ef as n,Fl as r,G as i,Il as a,Jc as o,Ju as s,Of as c,Tf as l,U as u,W as d,Wc as f,Yc as p,ba as m,bf as h,hf a...
L2: `)[0]??``).replace(/\S*\/journal\/\S*/g,`<journal path>`).replace(/\b[0-9a-f]{32}\b/gi,`<id>`);return`exit ${e.status}${t===``?``:`: ${t}`}`}function J(e,t,n){return{schemaVersion:...
...
L12: `)?`
L13: `:``;K(e,`${JSON.stringify(r,null,2)}${i}`)}catch{let r=En(n,t.contentDirSpellings);r!==n&&K(e,r)}}function jn(e,t){let n=U(e,`utf-8`),r=En(n,t.contentDirSpellings);r!==n&&K(e,r)}f...
L14: `)}\n`:null}catch{return null}}function ir(e){let t=R(e,`.git`,`ok`);if(!V(t))return null;let n=he(`git`,[`-C`,t,`log`,`--oneline`,`-50`],y({encoding:`utf-8`,timeout:2e3}));return ...
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
1import{t as e}from"./chunk-DXB73IDG-MLBj3lvC.mjs";function t(){let e=[{prop:`Function`,target:globalThis,violationType:`function_constructor`,strategy:`throw`,reason:`Function cons...
L2: `);n.register(`data:text/javascript,${encodeURIComponent(e)}`),i.importHooksRegistered=!0}}catch(e){console.debug(`[DefenseInDepthBox] Could not register import() hooks:`,e instanc...
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/cli.mjs:
import{o as e}from"./rolldown-runtime-tZXQYakl.mjs";import{$l as t,Ba as n,Bc as r,Cf as i,Cl as a,Dd as o,Df as s,Ed as c,Ef as l,F as u,Hd as d,Js as f,Ju as p,Lc as m,Ld as h,Lo...
`)}const _a={out:e=>process.stdout.write(`${e}\n`),err:e=>process.stderr.write(`${e}\n`)},va=D({title:v().optional(),error:v().optional(),message:v().optional()});function ya(e){re...
`)){let e=n.trim();if(e===``)continue;let r=e.indexOf(`=`);r!==-1&&(t[e.slice(0,r)]=e.slice(r+1))}return t}function Ta(e){return new Promise((t,n)=>{let r=[];e.on(`data`,e=>r.push(...
`;return`${I(`Error:`)} this project's git remote is ${n}, which is not a Git
High
Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
1Cross-file remote execution chain: dist/dist-CerHybyM.mjs spawns dist/chunk-5QMZ5MUS-BuB3i_B5.mjs; helper contains network access plus dynamic code execution.
L1: import{a as e,i as t,n,o as r,r as i,t as a}from"./rolldown-runtime-tZXQYakl.mjs";import{$ as o,$a as s,$c as c,$d as l,$i as u,$l as d,$n as f,$o as p,$r as m,$s as h,$t as g,$u a...
L2: `,t),r=n===-1?e.length:n;if(r>t&&e[r-1]===`\r`&&--r,r-t>1024)return 0;let i=e.slice(t,r);return i.length===0||!soe.test(i)&&!coe.test(i)?0:i.length}const uoe=/&#(?:x[0-9A-Fa-f]+|X[...
...
L66: </div>`}];function xoe(e){return["```html preview",e.html,"```"].join(`
L67: `)}const Soe=[{name:`--chart-1`,light:`oklch(0.62 0.19 259)`,dark:`oklch(0.72 0.14 259)`},{name:`--chart-2`,light:`oklch(0.58 0.14 145)`,dark:`oklch(0.73 0.13 145)`},{name:`--char
High
Cross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
7PQIDAQAB`,VITE_APP_DEBUG_ENABLE_TEXT_CONTAINER_BOUNDING_BOX:`false`,VITE_APP_COLLAPSE_OVERLAY:`false`,VITE_APP_ENABLE_ESLINT:`false`,PKG_NAME:`@excalidraw/excalidraw`,PKG_VERSION:`0.18.0`,PROD:!0};export{e as t};
Long lines were clipped for display.
1patternName = google_api_key
severity = high
line = 1
High
Secret Pattern
Google API key in dist/public/assets/chunk-A66AFZZU-SD63gUWy.js
1import{t as e}from"./chunk-DXB73IDG-MLBj3lvC.mjs";function t(){let e=[{prop:`Function`,target:globalThis,violationType:`function_constructor`,strategy:`throw`,reason:`Function cons...
L2: `);n.register(`data:text/javascript,${encodeURIComponent(e)}`),i.importHooksRegistered=!0}}catch(e){console.debug(`[DefenseInDepthBox] Could not register import() hooks:`,e instanc...
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/cli.mjs:
import{o as e}from"./rolldown-runtime-tZXQYakl.mjs";import{$l as t,Ba as n,Bc as r,Cf as i,Cl as a,Dd as o,Df as s,Ed as c,Ef as l,F as u,Hd as d,Js as f,Ju as p,Lc as m,Ld as h,Lo...
`)}const _a={out:e=>process.stdout.write(`${e}\n`),err:e=>process.stderr.write(`${e}\n`)},va=D({title:v().optional(),error:v().optional(),message:v().optional()});function ya(e){re...
`)){let e=n.trim();if(e===``)continue;let r=e.indexOf(`=`);r!==-1&&(t[e.slice(0,r)]=e.slice(r+1))}return t}function Ta(e){return new Promise((t,n)=>{let r=[];e.on(`data`,e=>r.push(...
`;return`${I(`Error:`)} this project's git remote is ${n}, which is not a Git
High
Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
1Cross-file remote execution chain: dist/dist-CerHybyM.mjs spawns dist/chunk-5QMZ5MUS-BuB3i_B5.mjs; helper contains network access plus dynamic code execution.
L1: import{a as e,i as t,n,o as r,r as i,t as a}from"./rolldown-runtime-tZXQYakl.mjs";import{$ as o,$a as s,$c as c,$d as l,$i as u,$l as d,$n as f,$o as p,$r as m,$s as h,$t as g,$u a...
L2: `,t),r=n===-1?e.length:n;if(r>t&&e[r-1]===`\r`&&--r,r-t>1024)return 0;let i=e.slice(t,r);return i.length===0||!soe.test(i)&&!coe.test(i)?0:i.length}const uoe=/&#(?:x[0-9A-Fa-f]+|X[...
...
L66: </div>`}];function xoe(e){return["```html preview",e.html,"```"].join(`
L67: `)}const Soe=[{name:`--chart-1`,light:`oklch(0.62 0.19 259)`,dark:`oklch(0.72 0.14 259)`},{name:`--chart-2`,light:`oklch(0.58 0.14 145)`,dark:`oklch(0.73 0.13 145)`},{name:`--char
High
Cross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
5`)){if(i.trim()===``||i.startsWith(`-- `))continue;let e=jt.exec(i);if(e===null){r+=1;continue}let[,a=``,o=``,s=``]=e;if(!_t.test(s)){n+=1;continue}let c=Ft(o,s);if(c===null){r+=1;continue}t.push({kind:`journal`,at:a,...c})}return{events:t,foreignIgnored:n,unparseable:r}}functionLt(e){let t=[],n=0,r=0;for(let i of e.split(`
6`)){if(i.trim()===``||i.startsWith(`-- `))continue;let e=jt.exec(i);if(e===null){r+=1;continue}let[,a=``,,o=``]=e,s=Mt.exec(o);if(s===null){n+=1;continue}t.push({at:a,pid:Number(s[1]),detail:(s[2]??``).slice(0,200)})}return{lines:t,foreignIgnored:n,unparseable:r}}asyncfunctionRt(e,t,n){let r=Lt(e);if(r.lines.length===0)return{...r,events:[],unattributed:null};let i=awaitPt(t,n),a=[],o=0;for(let e of r.lines){if(!i.pids.has(e.pid)){o+=1;continue}a.push({kind:`journal`,at:e.at,origin:`chromium`,action:`display-connection-lost`,pid:e.pid,processName:null,unit:null,trigger:/Wayland/.test(e.deta ...
15`:`not-running (${S})\n`;K(R(_,`state`,`server-status.txt`),k);let re=e.diagnosticReports===void 0?`not-collected (no collection attempted)`:it(e.diagnosticReports,v);if(K(R(_,`state`,`diagnostic-reports-status.txt`),`${re}\n`),K(R(_,ht),en(e.osTerminationEvidence)),e.processDir&&V(e.processDir)){let t=R(_,`process`);H(t,{recursive:!0}),be(e.processDir,t,{recursive:!0})}let A=e.redact===!0;A&&Ln({stagingDir:_,contentDir:t}),e.note&&K(R(_,`note.txt`),e.note);let j=null;e.scrubSecrets===!0&&(j=wr(_));for(let t of e.extraFiles??[]){let e=t.zipName??I(t.sourcePath);if(!Q(t.sourcePath,R(_,`extra`,e ...
16`)}asyncfunctionui(e={}){let t=e.discover??v,n=e.inspect??(e=>$(e,`server`)),r=e.log??(e=>console.log(e)),i=e.resolveCommand??C,a=e.resolveUsage??ae,o=awaitt(),s=[];for(let e of o){let t=n(e),r=ni(e,t,t.status===`missing`||t.status===`corrupt`||t.status===`read-error`||t.status===`unverified-owner`?null:i(t.lock.pid),t.status===`missing`||t.status===`corrupt`||t.status===`read-error`||t.status===`unverified-owner`?null:a(t.lock.pid));r!=null&&s.push(r)}if(e.json){let e=s.map(e=>({...e,displayStatus:ri(e)}));r(JSON.stringify(e,null,2));return}r(li(e.all?s:s.filter(e=>ii.has(ri(e)))))}functio ...
677`)?n:`${n}\n`)}const_o=10485760;functionvo(e,t){if(e===t)return!0;if(Array.isArray(e)||Array.isArray(t))return!Array.isArray(e)||!Array.isArray(t)||e.length!==t.length?!1:e.every((e,n)=>vo(e,t[n]));if(j(e)&&j(t)){let n=Object.keys(e);return n.length===Object.keys(t).length&&n.every(n=>Object.hasOwn(t,n)&&vo(e[n],t[n]))}return!1}functionyo(e,t,n){returnj(e)&&n.every(n=>vo(e[n],t[n]))}functionbo(e){for(let t of e.split(`
681`,g={...bo(m),eol:h},_=xo(t,i,n),v=m;if(o)for(let e of d?ji(u,r):[]){let t=de(v,[..._,e],void 0,{formattingOptions:g});v=pe(v,t)}else if(d&&!a&&Ei(u))for(let e of f){let t=de(v,[..._,e],r[e],{formattingOptions:g});v=pe(v,t)}else{let e=de(v,_,r,{formattingOptions:g});v=pe(v,e)}let y=`${p?``:``}${v}`;return y!==s&&T(e,y,{mode:Ia(e)}),o&&y===s?{kind:`unchanged`}:{kind:d?`overwritten`:`written`}}function To(e,t,n,r,i,a=!1,o=!1){let s=``;if(R(t))try{s=z(t,`utf-8`)}catch(e){return Y(`toml config read failed`,e),{kind:`declined`,reason:Ma(e)}}let c=s.trim()===``;if(c&&o)return{kind:`unchanged`};if(e ...
682`),p,m=!1;try{let t=Eo(e,u,n,r);if(o){let n=u;for(let a of t===void0?[]:ji(t,i))n=e.removeEntryKey(n,r,a).text;p={text:n,existed:t!==void0}}else{let n=Do(t,i,a);m=n.kind===`replace`;let o=m?e.removeEntry(u,r).text:u;if(n.kind===`merge`)for(let t of n.prune)o=e.removeEntryKey(o,r,t).text;p=e.upsertEntry(o,r,i)}}catch(e){return Y(`upsertEntry failed`,e),{kind:`declined`,reason:`unparseable`}}let h=p.text;f?h.endsWith(`
689`));let g=`${s?``:``}${m}`;return g!==o&&T(e,g,{mode:Ia(e)}),a&&g===o?{kind:`unchanged`}:{kind:d?`overwritten`:`written`}}const ko=e=>e!==`project`,Ao=e=>e!==`user`;async function jo(){let e=await Ga({message:`Where should the MCP server be configured?
690`,required:!1,theme:{icon:{checked:`[x]`,unchecked:`[ ]`}},choices:[{name:`User-level (~/.claude.json, ~/.cursor/mcp.json, …)`,value:`user`,checked:!0},{name:`Project-level (.mcp.json, .cursor/mcp.json, …)`,value:`project`,checked:!0}]});return e.includes(`user`)&&e.includes(`project`)?`both`:e.includes(`user`)?`user`:e.includes(`project`)?`project`:null}async function Mo(e){return e.mcp===!1?null:e.scope?e.scope:e.isTTY??process.stdout.isTTY?(e.promptFn??jo)():`both`}async function No(e){return Xa({message:`How do you want to handle OpenKnowledge config files (.ok/, .mcp.json)?`,default:e,c ...
691`)}functionts(e,t){return{projectRoot:e.projectRoot,gitRootPromoted:e.gitRootPromoted,promotedFromDir:e.promotedFromDir??null,contentDir:t.contentDir,contentDirRequested:e.contentDirRequested??null,contentDirApplied:e.contentDir!==void0,contentFileCount:t.contentFileCount,previewError:e.previewWarning??null,didGitInit:e.didGitInit,mcpAction:e.mcpAction,editors:e.editors.map(e=>({editorId:e.editorId,label:e.label,action:e.action,configPath:e.configPath,scope:e.configScope===`project`?`project`:`user`}))}}functionns(e,t){let n=[];for(let r of ri)r!==`claude-desktop`&&Bo($[r],e,t)&&n.push(r);r ...
693`))n.push(t.length>0?` ${t}`:``);return n.push(` Re-run ${E(`ok config-sharing unshare`)} after resolving to complete the switch.`),n;case`no-exclude`:if(e.localOnlyRequested)n.push(k(`Sharing mode: --local-only requested but no git repo found — option ignored`)),n.push(` Run ${E(`git init`)} (or open this folder via OK Desktop, which can scaffold a repo) and then ${E(`ok config-sharing unshare`)}.`);elseif(e.reason===`no-git`)return[];else n.push(k(`Sharing mode unavailable: ${e.reason}.`));return n}}export{Mi as$,La asA,ra asB,ro asC,xt asCt,Ga asD,Xa asE,ya asF,sa asG,oa asH,b ...