registry / @koda-sl/baker-cli / 0.567.0
@koda-sl/baker-cli@0.567.0
AI-agent-first CLI for interacting with Baker, including the Baker creative canvas.
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe package has no install hooks, and the reviewed network and process actions are tied to user-invoked CLI features. OpenRouter credentials go to OpenRouter’s API, while workspace downloads and media review match the package’s stated purpose.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
A user invokes a CLI command, such as an AI review or organization.pull.
Impact
The reviewed behavior processes command-selected content and writes downloaded organization content to the chosen folder; no unrelated collection or action was identified.
Mechanism
AI review sends its prompt and selected media to OpenRouter using OPENROUTER_API_KEY; organization.pull fetches published workspace content and extracts it with tar.
AI rationale
The package has no install hooks, and the reviewed network and process actions are tied to user-invoked CLI features. OpenRouter credentials go to OpenRouter’s API, while workspace downloads and media review match the package’s stated purpose.
Evidence
~/companies (organization.pull default target)<os.tmpdir()>/baker-workspace-*
Network endpoints2
openrouter.ai/api/v1/chat/completionsBAKER_API_URL (user-configured)
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest has no install lifecycle hooks; its scripts are build, development, typecheck, and test commands.
- The CLI dispatches the parsed user arguments to the selected command.
- The AI helper reads OPENROUTER_API_KEY and sends it as a bearer token to OpenRouter’s API with the supplied model and prompt.
- Video bytes are sent for the CLI’s video review operation, alongside its review prompt.
- organization.pull is described as downloading published company content and stages that content in a temporary directory before placing it at the selected target.
Evidence against
- The package has network and process-execution capabilities, but the reviewed uses are tied to explicit CLI operations.
- No reviewed credential flow sends Baker or OpenRouter credentials to an unrelated host.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork
Source & flagged code
10 flaggeddist/chunk-45D6WRCJ.jsView file
59patternName = generic_password
severity = medium
line = 59
Medium
60patternName = generic_password
severity = medium
line = 60
Medium
dist/organization-5JHFNUOD.jsView file
37// src/commands/organization/pull.ts
L38: import { execFile } from "child_process";
L39: import {
High
Child Process
Package source references child process execution.
dist/organization-5JHFNUOD.jsView on unpkg · L37Findings
3 Critical4 High6 Medium6 Low
CriticalTrojan Source Unicodedist/chunk-ARPT74DG.js
CriticalTrigger Reachable Dangerous Capabilitydist/chunk-ARPT74DG.js
CriticalPrevious Version Dangerous Deltadist/chunk-X6U3B6YK.js
HighChild Processdist/organization-5JHFNUOD.js
HighCommand Output Exfiltrationdist/chunk-DLM5OSHM.js#virtual:normalized:round1
HighTrigger Reachable Command Output Exfiltrationdist/chunk-DLM5OSHM.js#virtual:normalized:round1
HighSemantic Analysis Limiteddist/chunk-7M6GZI5B.js#virtual:normalized:round1
MediumSecret Patterndist/chunk-45D6WRCJ.js
MediumDynamic Requiredist/chunk-DWPOAU4Z.js
MediumNetwork
MediumEnvironment Vars
Affected versions and remediation
This report applies to @koda-sl/baker-cli@0.567.0.
See all versions of @koda-sl/baker-cli for other recorded verdicts.
- Review the evidence and your use of @koda-sl/baker-cli@0.567.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.