registry / @koda-sl/baker-cli / 0.624.0
@koda-sl/baker-cli@0.624.0
AI-agent-first CLI for interacting with Baker, including the Baker creative canvas.
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe flagged command execution and network access serve the package's media review and AI features. Its debug capture is opt-in and local, and the Unicode finding is an identifier-validation regex rather than concealed control flow.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
AI requests occur when review features call the gateway and an OpenRouter key is configured; debug logging requires a debug-log setting.
Impact
No unauthorized credential transfer, install-time activity or unrelated account action was identified.
Mechanism
The CLI processes supplied media with ffmpeg tools, sends review prompts and media to OpenRouter, and can optionally record debug details locally.
AI rationale
The flagged command execution and network access serve the package's media review and AI features. Its debug capture is opt-in and local, and the Unicode finding is an identifier-validation regex rather than concealed control flow.
Evidence
baker-cli-debug.jsonl
Network endpoints1
openrouter.ai/api/v1/chat/completions
Decision evidence
public snapshotAI called this Clean at 90.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package has no install lifecycle scripts; its declared scripts are build, dev, typecheck and test.
- Video processing invokes ffprobe with a supplied video path to inspect its audio stream; the result is used as metadata.
- AI review uses OPENROUTER_API_KEY and sends requests to OpenRouter's API, consistent with the CLI's AI review features.
- Debug logging is disabled unless a debug-log setting is provided; when enabled, output is written to a local file.
- The flagged zero-width characters appear in a Unicode identifier-validation regex, not in concealed executable logic.
Evidence against
- The static scanner flagged command execution, network access and Unicode controls, but the inspected code ties them to media processing, AI requests and identifier validation.
- No install-time hook or automatic outbound request was identified in the manifest or inspected CLI startup code.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystem
Source & flagged code
8 flaggeddist/chunk-3WEWQWRV.jsView file
59patternName = generic_password
severity = medium
line = 59
Medium
60patternName = generic_password
severity = medium
line = 60
Medium
dist/chats-7PL5XTOA.jsView file
31// src/commands/chats/carry-files.ts
L32: import { execFileSync } from "child_process";
L33: async function readSourceFiles(fromChatId) {
High
Child Process
Package source references child process execution.
dist/chats-7PL5XTOA.jsView on unpkg · L31Findings
2 Critical4 High6 Medium6 Low
CriticalTrojan Source Unicodedist/chunk-HVG3E7Y5.js
CriticalTrigger Reachable Dangerous Capabilitydist/chunk-HVG3E7Y5.js
HighChild Processdist/chats-7PL5XTOA.js
HighCommand Output Exfiltrationdist/chunk-6XWTVAJN.js#virtual:normalized:round1
HighTrigger Reachable Command Output Exfiltrationdist/chunk-6XWTVAJN.js#virtual:normalized:round1
HighSemantic Analysis Limiteddist/add-JH3RJT5H.js#virtual:string-array:round1
MediumSecret Patterndist/chunk-3WEWQWRV.js
MediumDynamic Require
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumSecret Patterndist/chunk-3WEWQWRV.js
Affected versions and remediation
This report applies to @koda-sl/baker-cli@0.624.0.
See all versions of @koda-sl/baker-cli for other recorded verdicts.
- Review the evidence and your use of @koda-sl/baker-cli@0.624.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.