@intutic/cli@3.1.1
Policy-as-code gates and a local proxy for AI agents: enforce your rules at the tool call, across 43 harnesses
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe package is not clearly malicious, but `skill list` automatically sends local skill paths and counts to the configured service without a visible opt-out. This is identifying runtime telemetry, so warn rather than block.
Static reason
No blocking static signals were detected.
Trigger
A logged-in user runs `intutic skill list` with discovered files, or runs an enforcement/disconnect operation.
Impact
The service receives local skill names and device identity information; no credential theft or unrelated collector was identified.
Mechanism
The CLI posts skill file paths and counts, or device fingerprints and hostnames, using the saved control-plane credentials.
AI rationale
The package is not clearly malicious, but `skill list` automatically sends local skill paths and counts to the configured service without a visible opt-out. This is identifying runtime telemetry, so warn rather than block.
Evidence
dist/commands/skill.jsdist/lib/deviceReport.jsdist/commands/enforce.js
Network endpoints3
Configured Intutic control plane: /api/v1/workspaces/{workspaceId}/skills/reportConfigured Intutic control plane: /api/v1/devices/reportConfigured Intutic control plane: /api/v1/devices/disconnect
Decision evidence
public snapshotAI called this Suspicious at 84.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- `intutic skill list` sends discovered skill file paths and line counts to the control plane when credentials exist and matching files are found.
- The skill report is sent automatically by the explicitly invoked `skill list` command; the command description does not mention uploading this metadata.
- Device reports include a fingerprint and hostname, but the source ties them to enforcement or disconnect operations.
Evidence against
- The package has no lifecycle scripts; daemon persistence is exposed through explicit install commands.
- The CLI’s skill listing and auditing are explicit subcommands, not import-time behavior.
- The reporting targets the configured Intutic control plane and is conditional on stored credentials.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStrings
Source & flagged code
8 flaggeddist/lib/controlPlanePlugin.jsView file
75* package that is not installed (not for one of that package's own imports),
L76: * or a single-file `pkg` binary, where a run-time import() of anything fails
L77: * with ERR_VM_DYNAMIC_IMPORT_CALLBACK_MISSING.
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/lib/controlPlanePlugin.jsView on unpkg · L75dist/commands/rollback.jsView file
29import { log } from '../lib/logger.js';
L30: const ROLLBACK_DIR = () => path.join(process.cwd(), '.intutic', 'rollback');
L31: const MANIFEST = () => path.join(ROLLBACK_DIR(), 'manifest.jsonl');
...
L37: .filter(Boolean)
L38: .map((l) => JSON.parse(l));
L39: }
...
L101: log.error(`No captured pre-image with id ${opts.id}. Run \`intutic rollback\` to list them.`);
L102: process.exitCode = 1;
L103: return;
Low
Weak Crypto
Package source references weak cryptographic algorithms.
dist/commands/rollback.jsView on unpkg · L29Findings
3 High7 Medium5 Low
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/commands/skill.js
HighTrigger Reachable Persistencedist/commands/install-daemon.js
HighSemantic Analysis Limiteddist/cli.js#virtual:normalized:round1
MediumDynamic Requiredist/lib/controlPlanePlugin.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/lib/envInjector.js
MediumShips Native Binaryresources/sandbox/Dockerfile.node
MediumShips Build Helperresources/sandbox/firecracker-launch.sh
MediumStructural Risk Force Deep Review
LowScripts Present
LowWeak Cryptodist/commands/rollback.js
Low
Affected versions and remediation
This report applies to @intutic/cli@3.1.1.
See all versions of @intutic/cli for other recorded verdicts.
- Review the evidence and your use of @intutic/cli@3.1.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.