registry / @intentic/cli / 1.63.0

@intentic/cli@1.63.0

AI Security Review

scanned 2d ago · by lpm-firewall-ai

No confirmed malicious attack surface: risky primitives are tied to explicit deployment, tunnel, scaffold, and demo commands. There is no install-time execution or hidden mutation of foreign control surfaces.

Static reason

One or more suspicious static signals were detected.

Trigger

Explicit CLI command such as intentic init, resolve, apply, sandbox-tunnel, host-ssh-tunnel, or direct demo invocation.

Impact

Creates project files, resolves desired-state, manages Cloudflare/SSH/Docker resources according to user configuration.

Mechanism

User-invoked deployment orchestration and project scaffolding.

Rationale

Static source inspection shows a deployment CLI with explicit commands for scaffolding, resolving, applying, tunnels, and demos; the scanner hits are package-aligned user-invoked behavior. No lifecycle hook, covert exfiltration, persistence, or AI-agent control hijack was found.

Evidence

package.jsondist/cli.jsdist/app.jsdist/init/init.jsdist/init/scaffold-app.jsdist/resolve/resolve.jsdist/apply/apply.command.jsdist/demo.jsdist/sandbox-tunnel/sandbox-tunnel.jsdist/host-ssh-tunnel/host-ssh-tunnel.jsintent/deploy.config.tsintent/package.jsonintent/tsconfig.jsondesired-state/desired-state.jsondesired-state/.env.exampledesired-state/.secrets.jsondesired-state/.last-applied.jsondesired-state/status.jsondesired-state/access.mdapp/package.jsonapp/server.jsapp/Dockerfile.demo/state.json/opt/intentic/secrets.json

Network endpoints3

api.cloudflare.com/client/v4github.com/actions/checkoutregistry.npmjs.org/

Decision evidence

public snapshot

AI called this Clean at 91.0% confidence as Benign with low false-positive risk.

Evidence for block

User-invoked commands can execute git/pnpm/docker and SSH operations for scaffolding/demo/deploy workflows.
User-invoked Cloudflare tunnel/DNS actions use API tokens from env or desired-state .env.

Evidence against

package.json has no npm lifecycle hooks; only bin is dist/cli.js.
dist/cli.js only dispatches stricli commands; no install/import-time side effects found.
dist/init/init.js scaffolds intent/ desired-state/ app/ and runs pnpm install only when user runs intentic init.
dist/resolve/resolve.js dynamically imports the user-supplied deploy config and calls Cloudflare zone listing for deployment resolution.
dist/demo.js docker/SSH/fetch behavior is demo-mode orchestration, not lifecycle-triggered exfiltration.
No AI-agent control-surface writes, persistence hooks, credential harvesting, or hidden remote code loading found.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 37 file(s), 88.8 KB of source, external domains: 127.0.0.1, api.cloudflare.com

Source & flagged code

4 flagged

dist/init/scaffold-app.jsView file

Lines 1-21javascript

1import { execFile } from "node:child_process";

2import { mkdir, writeFile } from "node:fs/promises";

High

Child Process

Package source references child process execution.

dist/init/scaffold-app.jsView on unpkg · L1

3import { join } from "node:path";

4import { promisify } from "node:util";

5import { renderTemplate } from "../lib/templates.js";

6const exec = promisify(execFile);

7const APP_GITIGNORE = "node_modules/\n";

8const STARTER_APP_PACKAGE = `${JSON.stringify({

9 name: "app",

10 version: "0.0.0",

11 private: true,

12 type: "module",

13 scripts: { dev: "node server.js", start: "node server.js" },

14}, undefined, 4)}\n`;

15export const scaffoldApp = async (appDir, appRepo) => {

16 if (appRepo !== undefined) {

17 await exec("git", ["clone", "-q", appRepo, appDir]);

18 return;

19 }

20 await mkdir(appDir, { recursive: true });

21 await exec("git", ["init", "-q", appDir]);

dist/resolve/resolve.jsView file

Lines 1-26javascript

1import { resolve } from "node:path";

2import { pathToFileURL } from "node:url";

3import { cloudflareApi } from "@intentic/providers";

4import { collectDomains, selectZone } from "@intentic/state-resolver";

5import { loadEnvFile } from "../lib/artifact.js";

dist/demo.jsView file

Lines 9-49javascript

9import { loadConfig } from "./env.config.js";

10import { renderTemplate } from "./lib/templates.js";

11import { readGeneratedSecrets } from "./secrets/generated-secrets.js";

12const { utils } = createRequire(import.meta.url)("ssh2");

Source & flagged code

4 flagged · loading source

dist/init/scaffold-app.jsView file

1import { execFile } from "node:child_process"; L2: import { mkdir, writeFile } from "node:fs/promises";

High

Child Process

Package source references child process execution.

dist/init/scaffold-app.jsView on unpkg · L1

dist/resolve/resolve.jsView file

6export const loadIntent = async (configPath) => { L7: const loaded = (await import(pathToFileURL(resolve(configPath)).href)); L8: if (loaded.intent === undefined) {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/resolve/resolve.jsView on unpkg · L6

dist/demo.jsView file

29const komodoPort = config.demo.komodoPort; L30: const GIT_URL = `https://git.${zone}`; L31: const KOMODO_URL = `https://deploy.${zone}`; ... L38: const cliEnv = { L39: ...process.env, L40: DEMO_DOH_ZONE: zone, ... L43: const run = (command, args, env = process.env) => new Promise((resolve, reject) => { L44: const child = spawn(command, args, { cwd: repoRoot, env, stdio: ["ignore", "inherit", "inherit"] }); L45: child.on("error", reject);

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/demo.jsView on unpkg · L29

29const komodoPort = config.demo.komodoPort; L30: const GIT_URL = `https://git.${zone}`; L31: const KOMODO_URL = `https://deploy.${zone}`; ... L33: const log = (message) => { L34: process.stdout.write(`${message}\n`); L35: }; ... L43: const run = (command, args, env = process.env) => new Promise((resolve, reject) => { L44: const child = spawn(command, args, { cwd: repoRoot, env, stdio: ["ignore", "inherit", "inherit"] }); L45: child.on("error", reject);

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/demo.jsView on unpkg · L29

Findings

4 High3 Medium4 Low

HighChild Processdist/init/scaffold-app.js

HighShell

HighSame File Env Network Executiondist/demo.js

HighCommand Output Exfiltrationdist/demo.js

MediumDynamic Requiredist/resolve/resolve.js

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

dist/init/scaffold-app.jsView file

Lines 1-21javascript

1import { execFile } from "node:child_process";

2import { mkdir, writeFile } from "node:fs/promises";

High

Child Process

Package source references child process execution.

dist/init/scaffold-app.jsView on unpkg · L1

3import { join } from "node:path";

4import { promisify } from "node:util";

5import { renderTemplate } from "../lib/templates.js";

6const exec = promisify(execFile);

7const APP_GITIGNORE = "node_modules/\n";

8const STARTER_APP_PACKAGE = `${JSON.stringify({

9 name: "app",

10 version: "0.0.0",

11 private: true,

12 type: "module",

13 scripts: { dev: "node server.js", start: "node server.js" },

14}, undefined, 4)}\n`;

15export const scaffoldApp = async (appDir, appRepo) => {

16 if (appRepo !== undefined) {

17 await exec("git", ["clone", "-q", appRepo, appDir]);

18 return;

19 }

20 await mkdir(appDir, { recursive: true });

21 await exec("git", ["init", "-q", appDir]);

dist/resolve/resolve.jsView file

Lines 1-26javascript

1import { resolve } from "node:path";

2import { pathToFileURL } from "node:url";

3import { cloudflareApi } from "@intentic/providers";

4import { collectDomains, selectZone } from "@intentic/state-resolver";

5import { loadEnvFile } from "../lib/artifact.js";

dist/demo.jsView file

Lines 9-49javascript

9import { loadConfig } from "./env.config.js";

10import { renderTemplate } from "./lib/templates.js";

11import { readGeneratedSecrets } from "./secrets/generated-secrets.js";

12const { utils } = createRequire(import.meta.url)("ssh2");