registry / @koda-sl/baker-cli / 0.623.0
@koda-sl/baker-cli@0.623.0
AI-agent-first CLI for interacting with Baker, including the Baker creative canvas.
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe routed credential flow reads OPENROUTER_API_KEY and sends it to OpenRouter for model-review requests. The Unicode alert points to zero-width characters in a Unicode identifier regex, and debug capture is opt-in and local.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A model-review feature is invoked and an OpenRouter key is available; local debug capture requires BAKER_DEBUG_LOG to be set.
Impact
No unauthorized credential transfer or other malicious impact was identified in the inspected flows.
Mechanism
Review requests use OPENROUTER_API_KEY to call OpenRouter. Optional debug records are written to a local file.
AI rationale
The routed credential flow reads OPENROUTER_API_KEY and sends it to OpenRouter for model-review requests. The Unicode alert points to zero-width characters in a Unicode identifier regex, and debug capture is opt-in and local.
Evidence
baker-cli-debug.jsonl (when debug logging is enabled; configurable path)
Network endpoints2
openrouter.ai/api/v1/chat/completionsopenrouter.ai/api/v1/systemone
Decision evidence
public snapshotAI called this Clean at 93.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest describes a Baker creative canvas CLI and routes its command and library exports to dist entry points.
- OpenRouter requests use the explicitly named OPENROUTER_API_KEY environment variable.
- The model-review request is gated on that key and sends a bearer-authenticated request to OpenRouter.
- The flagged zero-width characters occur in a Unicode identifier-continuation regex.
- Debug logging is disabled unless BAKER_DEBUG_LOG is set and writes to a local file.
Evidence against
- Model-review requests can send the supplied prompt and media to OpenRouter when the feature is used.
- When explicitly enabled, debug logging can capture CLI output and HTTP request and response data locally.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStringsTelemetryUrlStrings
Source & flagged code
8 flaggeddist/chunk-3WEWQWRV.jsView file
59patternName = generic_password
severity = medium
line = 59
Medium
60patternName = generic_password
severity = medium
line = 60
Medium
dist/chats-7PL5XTOA.jsView file
31// src/commands/chats/carry-files.ts
L32: import { execFileSync } from "child_process";
L33: async function readSourceFiles(fromChatId) {
High
Child Process
Package source references child process execution.
dist/chats-7PL5XTOA.jsView on unpkg · L31Findings
2 Critical4 High6 Medium6 Low
CriticalTrojan Source Unicodedist/chunk-HVG3E7Y5.js
CriticalTrigger Reachable Dangerous Capabilitydist/chunk-HVG3E7Y5.js
HighChild Processdist/chats-7PL5XTOA.js
HighCommand Output Exfiltrationdist/chunk-6XWTVAJN.js#virtual:normalized:round1
HighTrigger Reachable Command Output Exfiltrationdist/chunk-6XWTVAJN.js#virtual:normalized:round1
HighSemantic Analysis Limiteddist/add-JH3RJT5H.js#virtual:string-array:round1
MediumSecret Patterndist/chunk-3WEWQWRV.js
MediumDynamic Require
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumSecret Patterndist/chunk-3WEWQWRV.js
Affected versions and remediation
This report applies to @koda-sl/baker-cli@0.623.0.
See all versions of @koda-sl/baker-cli for other recorded verdicts.
- Review the evidence and your use of @koda-sl/baker-cli@0.623.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.