registry / @koda-sl/baker-cli / 0.593.0
@koda-sl/baker-cli@0.593.0
AI-agent-first CLI for interacting with Baker, including the Baker creative canvas.
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe inspected indicators match the package’s stated AI CLI purpose: OpenRouter requests are keyed by OPENROUTER_API_KEY, while ffmpeg/ffprobe inspect review media. The manifest has no install lifecycle scripts, and the flagged Unicode characters occur in a Unicode identifier regex rather than concealed control flow.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
AI requests require the corresponding feature to be used and an OpenRouter key to be configured; video processing follows a video review request.
Impact
No unrelated credential transfer or harmful automatic action was identified.
Mechanism
Sends review prompts and media to OpenRouter using OPENROUTER_API_KEY, and uses ffmpeg/ffprobe locally to inspect requested media.
AI rationale
The inspected indicators match the package’s stated AI CLI purpose: OpenRouter requests are keyed by OPENROUTER_API_KEY, while ffmpeg/ffprobe inspect review media. The manifest has no install lifecycle scripts, and the flagged Unicode characters occur in a Unicode identifier regex rather than concealed control flow.
Evidence
/tmp/baker-review-*src/lib/flow-engine/flows/<slug>/_data.json
Network endpoints2
openrouter.ai/api/v1/chat/completionsopenrouter.ai/api/v1/systemone
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest describes an AI-agent CLI and exposes its CLI and engine entry points; it declares no install lifecycle scripts.
- The AI gateway reads OPENROUTER_API_KEY and returns without making a request when the key is absent.
- AI requests send prompts and review parts to OpenRouter, the service associated with that key.
- Video review uses ffmpeg to extract frames from the selected video before sending them for review; the flagged Unicode characters are part of a Unicode identifier regex.
Evidence against
- The package invokes ffmpeg and ffprobe, but the inspected calls analyze a video file for duration, audio, or frames.
- The flagged flow-management code writes flow data under the project’s src/lib/flow-engine/flows directory; no unrelated automatic write was identified.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStrings
Source & flagged code
10 flaggeddist/chunk-56ISH6CN.jsView file
59patternName = generic_password
severity = medium
line = 59
Medium
60patternName = generic_password
severity = medium
line = 60
Medium
dist/chats-OL2ZXLPP.jsView file
31// src/commands/chats/carry-files.ts
L32: import { execFileSync } from "child_process";
L33: async function readSourceFiles(fromChatId) {
High
Child Process
Package source references child process execution.
dist/chats-OL2ZXLPP.jsView on unpkg · L31Findings
3 Critical4 High6 Medium6 Low
CriticalTrojan Source Unicodedist/chunk-3KG63U5B.js
CriticalTrigger Reachable Dangerous Capabilitydist/chunk-3KG63U5B.js
CriticalPrevious Version Dangerous Deltadist/chunk-7FRBB4P3.js
HighChild Processdist/chats-OL2ZXLPP.js
HighCommand Output Exfiltrationdist/chunk-RQ7SBNPW.js#virtual:normalized:round1
HighTrigger Reachable Command Output Exfiltrationdist/chunk-RQ7SBNPW.js#virtual:normalized:round1
HighSemantic Analysis Limiteddist/chunk-6DIB7LRE.js#virtual:normalized:round1
MediumSecret Patterndist/chunk-56ISH6CN.js
MediumDynamic Requiredist/chunk-7FRBB4P3.js
MediumNetwork
MediumEnvironment Vars
Affected versions and remediation
This report applies to @koda-sl/baker-cli@0.593.0.
See all versions of @koda-sl/baker-cli for other recorded verdicts.
- Review the evidence and your use of @koda-sl/baker-cli@0.593.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.