@intutic/cli@3.0.1
Intutic CLI — sync daemon, harness detection, and workspace management
AI Security Review
scanned 17d ago · by lpm-firewall-aiThe source shows that saved credentials accompany requests to a control-plane URL that can be overridden without checking that it matches the credential’s original service. Custom endpoints are a supported feature, so this warrants a warning for conditional credential exposure rather than a block.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Trigger
An authenticated command uses saved credentials while a command-line or environment override selects a different control-plane URL.
Impact
If the selected endpoint is outside the intended service, its operator receives the bearer credential.
Mechanism
The URL resolver accepts those overrides, and the API client sends the saved key as a bearer credential without binding it to the control plane where it was obtained.
AI rationale
The source shows that saved credentials accompany requests to a control-plane URL that can be overridden without checking that it matches the credential’s original service. Custom endpoints are a supported feature, so this warrants a warning for conditional credential exposure rather than a block.
Evidence
dist/config/paths.jsdist/lib/api.jsdist/config/store.jsdist/commands/connect.jsdist/commands/skill.jsdist/lib/deviceReport.jsdist/harness/antigravity.jsdist/harness/windsurf.js
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Saved API credentials are retrieved from local credential storage or its fallback.
- The API client sends the saved key as a bearer credential to the URL built from the configured control-plane address.
- The URL resolver accepts command-line and environment overrides before stored or hosted defaults, without binding the saved key to its original control plane.
- Authenticated connect, skill, device-report, and sync callers reuse saved credentials for control-plane requests.
- The CLI also supports caller-supplied credentials and custom control-plane URLs, which supports legitimate self-hosted use.
Evidence against
- The source supports custom control-plane deployments, and does not establish a fixed unrelated recipient or hidden credential transfer.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
8 flaggeddist/commands/rollback.jsView file
29import { log } from '../lib/logger.js';
L30: const ROLLBACK_DIR = () => path.join(process.cwd(), '.intutic', 'rollback');
L31: const MANIFEST = () => path.join(ROLLBACK_DIR(), 'manifest.jsonl');
...
L37: .filter(Boolean)
L38: .map((l) => JSON.parse(l));
L39: }
...
L101: log.error(`No captured pre-image with id ${opts.id}. Run \`intutic rollback\` to list them.`);
L102: process.exitCode = 1;
L103: return;
Low
Weak Crypto
Package source references weak cryptographic algorithms.
dist/commands/rollback.jsView on unpkg · L29dist/lib/envInjector.jsView file
8* Platform support:
L9: * macOS: launchctl setenv <KEY> <VALUE> (until logout)
L10: * Linux: /etc/environment when writable (root), else ~/.bashrc
...
L14: */
L15: import { execSync } from 'node:child_process';
L16: import fs from 'node:fs';
...
L24: platform: t.platform ?? os.platform(),
L25: bashrc: t.bashrc ?? path.join(os.homedir(), '.bashrc'),
L26: etcEnvironment: t.etcEnvironment ?? '/etc/environment',
...
L106: *
L107: * @param proxyUrl - The Intutic proxy URL (e.g. https://proxy.acme.intutic.ai)
L108: * @returns InjectionResult describing what was done
Medium
Install Persistence
Source writes installer persistence such as shell profile or service configuration.
Findings
4 High6 Medium5 Low
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/commands/skill.js
HighTrigger Reachable Persistencedist/commands/install-daemon.js
HighSemantic Analysis Limiteddist/commands/decide.js#virtual:normalized:round1
HighPrevious Version Dangerous Deltadist/commands/connect.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/lib/envInjector.js
MediumShips Native Binaryresources/sandbox/Dockerfile.node
MediumShips Build Helperresources/sandbox/firecracker-launch.sh
MediumStructural Risk Force Deep Review
LowScripts Present
LowWeak Cryptodist/commands/rollback.js
Affected versions and remediation
This report applies to @intutic/cli@3.0.1.
See all versions of @intutic/cli for other recorded verdicts.
- Review the evidence and your use of @intutic/cli@3.0.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.