registry / @koda-sl/baker-cli / 0.599.0
@koda-sl/baker-cli@0.599.0
AI-agent-first CLI for interacting with Baker, including the Baker creative canvas.
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe flagged subprocess and outbound request behavior implements Baker’s stated AI creative and media-review purpose. The OpenRouter key goes to OpenRouter, media review is conditional on a supplied key, and the flagged Unicode characters occur in an identifier-validation regex.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
A user runs a Baker command that renders or reviews media; AI requests require an OpenRouter key.
Impact
Media submitted for the requested Baker workflow is processed by the intended model service; no unrelated credential collection or destination was found.
Mechanism
The CLI uses ffmpeg/ffprobe to inspect media, then can send review prompts and extracted images to OpenRouter using OPENROUTER_API_KEY.
AI rationale
The flagged subprocess and outbound request behavior implements Baker’s stated AI creative and media-review purpose. The OpenRouter key goes to OpenRouter, media review is conditional on a supplied key, and the flagged Unicode characters occur in an identifier-validation regex.
Evidence
tmpdir()/baker-review-*/fNN.jpg
Network endpoints2
openrouter.ai/api/v1/chat/completionsopenrouter.ai/api/v1/systemone
Decision evidence
public snapshotAI called this Clean at 96.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest describes an AI creative CLI and declares no install lifecycle hooks.
- CLI work runs through command dispatch based on the supplied arguments.
- AI requests use OPENROUTER_API_KEY and send requests to OpenRouter’s API.
- Media review is conditional on a video and an OpenRouter key; it extracts temporary frames and sends review prompts and images to the configured model service.
- The flagged invisible characters appear in a Unicode identifier-validation regex, not concealed control flow.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStringsTelemetryUrlStrings
NoLicense
Source & flagged code
9 flaggeddist/chunk-56ISH6CN.jsView file
59patternName = generic_password
severity = medium
line = 59
Medium
60patternName = generic_password
severity = medium
line = 60
Medium
dist/chats-LGEPI4AL.jsView file
31// src/commands/chats/carry-files.ts
L32: import { execFileSync } from "child_process";
L33: async function readSourceFiles(fromChatId) {
High
Child Process
Package source references child process execution.
dist/chats-LGEPI4AL.jsView on unpkg · L31Findings
3 Critical4 High6 Medium6 Low
CriticalTrojan Source Unicodedist/chunk-HQS7VE4Z.js
CriticalTrigger Reachable Dangerous Capabilitydist/chunk-HQS7VE4Z.js
CriticalPrevious Version Dangerous Deltadist/chunk-D6MHRP6A.js
HighChild Processdist/chats-LGEPI4AL.js
HighCommand Output Exfiltrationdist/chunk-D6MHRP6A.js#virtual:normalized:round1
HighTrigger Reachable Command Output Exfiltrationdist/chunk-D6MHRP6A.js#virtual:normalized:round1
HighSemantic Analysis Limiteddist/chunk-D6MHRP6A.js#virtual:normalized:round1
MediumSecret Patterndist/chunk-56ISH6CN.js
MediumDynamic Require
MediumNetwork
MediumEnvironment Vars
Medium
Affected versions and remediation
This report applies to @koda-sl/baker-cli@0.599.0.
See all versions of @koda-sl/baker-cli for other recorded verdicts.
- Review the evidence and your use of @koda-sl/baker-cli@0.599.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.