registry / @intentic/cli / 1.93.1

@intentic/cli@1.93.1

AI Security Review

scanned 16m ago · by lpm-firewall-ai

No confirmed malicious attack surface was established. The package is a deployment CLI with explicit commands that scaffold repos, manage generated secrets, SSH/Docker resources, Forgejo repos, and Cloudflare tunnels/DNS.

Static reason

One or more suspicious static signals were detected.

Trigger

User explicitly runs intentic commands such as init, resolve, apply, adopt, sandbox-tunnel, host-ssh-tunnel, or demo up/clear.

Impact

Expected project/infra changes for configured intent; no install-time execution or unconsented exfiltration identified.

Mechanism

user-invoked deployment automation

Rationale

Static inspection shows suspicious primitives are package-aligned deployment/demo functionality gated by explicit CLI commands, with no lifecycle hooks, import-time payload, credential exfiltration, persistence, or AI-agent control hijack. Mark clean despite scanner noise.

Evidence

package.jsondist/cli.jsdist/app.jsdist/init/init.jsdist/init/scaffold-app.jsdist/resolve/resolve.jsdist/apply/apply.command.jsdist/demo.jsdist/secrets/secret-store.jsdist/adopt/adopt.command.jsintent/deploy.config.tsintent/package.jsonintent/tsconfig.jsonintent/.gitignoredesired-state/.gitignoredesired-state/.envdesired-state/.secrets.jsondesired-state/status.jsondesired-state/access.mddesired-state/.last-applied.jsonapp/package.jsonapp/server.jsapp/Dockerfileapp/.gitignore.demo/state.json/opt/intentic/secrets.json

Network endpoints3

api.cloudflare.com/client/v4github.com/actions/checkoutregistry.npmjs.org/

Decision evidence

public snapshot

AI called this Clean at 90.0% confidence as Benign with low false-positive risk.

Evidence for block

dist/demo.js can run docker/git/CLI commands and write desired-state/.env, .demo/state.json, and Cloudflare DNS/tunnels when invoked as demo up/clear.
dist/resolve/resolve.js and dist/apply/apply.command.js read env secrets and call provider/network APIs for deployment workflows.
dist/init/init.js runs git init and pnpm install during explicit intentic init scaffolding.

Evidence against

package.json has no preinstall/install/postinstall lifecycle scripts; bin only dispatches CLI commands via dist/cli.js.
dist/app.js exposes deployment-oriented commands; risky primitives are behind explicit user commands, not install/import time.
dist/demo.js network and command execution are demo infrastructure actions using Docker, local services, Forgejo, SSH, and Cloudflare for package-aligned deployment.
dist/resolve/resolve.js uses Cloudflare API token only to list zones for configured intent; no exfiltration sink found.
dist/secrets/* stores generated secrets locally or on configured host paths for deployment state; no broad credential harvesting observed.
No AI-agent control-surface writes or reviewer prompt manipulation found in inspected package files.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 37 file(s), 91.6 KB of source, external domains: 127.0.0.1, api.cloudflare.com

Source & flagged code

4 flagged

dist/init/scaffold-app.jsView file

Lines 1-21javascript

1import { execFile } from "node:child_process";

2import { mkdir, writeFile } from "node:fs/promises";

High

Child Process

Package source references child process execution.

dist/init/scaffold-app.jsView on unpkg · L1

3import { join } from "node:path";

4import { promisify } from "node:util";

5import { renderTemplate } from "../lib/templates.js";

6const exec = promisify(execFile);

7const APP_GITIGNORE = "node_modules/\n";

8const STARTER_APP_PACKAGE = `${JSON.stringify({

9 name: "app",

10 version: "0.0.0",

11 private: true,

12 type: "module",

13 scripts: { dev: "node server.js", start: "node server.js" },

14}, undefined, 4)}\n`;

15export const scaffoldApp = async (appDir, appRepo) => {

16 if (appRepo !== undefined) {

17 await exec("git", ["clone", "-q", appRepo, appDir]);

18 return;

19 }

20 await mkdir(appDir, { recursive: true });

21 await exec("git", ["init", "-q", appDir]);

dist/resolve/resolve.jsView file

Lines 1-26javascript

1import { resolve } from "node:path";

2import { pathToFileURL } from "node:url";

3import { cloudflareApi } from "@intentic/providers";

4import { collectDomains, selectZone } from "@intentic/state-resolver";

5import { loadEnvFile } from "../lib/artifact.js";

dist/demo.jsView file

Lines 9-49javascript

9import { loadConfig } from "./env.config.js";

10import { renderTemplate } from "./lib/templates.js";

11import { readGeneratedSecrets } from "./secrets/generated-secrets.js";

12const { utils } = createRequire(import.meta.url)("ssh2");

Source & flagged code

4 flagged · loading source

dist/init/scaffold-app.jsView file

1import { execFile } from "node:child_process"; L2: import { mkdir, writeFile } from "node:fs/promises";

High

Child Process

Package source references child process execution.

dist/init/scaffold-app.jsView on unpkg · L1

dist/resolve/resolve.jsView file

6export const loadIntent = async (configPath) => { L7: const loaded = (await import(pathToFileURL(resolve(configPath)).href)); L8: if (loaded.intent === undefined) {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/resolve/resolve.jsView on unpkg · L6

dist/demo.jsView file

29const komodoPort = config.demo.komodoPort; L30: const GIT_URL = `https://git.${zone}`; L31: const KOMODO_URL = `https://deploy.${zone}`; ... L38: const cliEnv = { L39: ...process.env, L40: DEMO_DOH_ZONE: zone, ... L43: const run = (command, args, env = process.env) => new Promise((resolve, reject) => { L44: const child = spawn(command, args, { cwd: repoRoot, env, stdio: ["ignore", "inherit", "inherit"] }); L45: child.on("error", reject);

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/demo.jsView on unpkg · L29

29const komodoPort = config.demo.komodoPort; L30: const GIT_URL = `https://git.${zone}`; L31: const KOMODO_URL = `https://deploy.${zone}`; ... L33: const log = (message) => { L34: process.stdout.write(`${message}\n`); L35: }; ... L43: const run = (command, args, env = process.env) => new Promise((resolve, reject) => { L44: const child = spawn(command, args, { cwd: repoRoot, env, stdio: ["ignore", "inherit", "inherit"] }); L45: child.on("error", reject);

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/demo.jsView on unpkg · L29

Findings

4 High3 Medium4 Low

HighChild Processdist/init/scaffold-app.js

HighShell

HighSame File Env Network Executiondist/demo.js

HighCommand Output Exfiltrationdist/demo.js

MediumDynamic Requiredist/resolve/resolve.js

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings