registry / @legdev/tkxr / 2.1.4

@legdev/tkxr@2.1.4

In-repo ticket management system with CLI and web interface

AI Security Review

scanned 9h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User runs `tkxr serve`, Claude is available locally, then a client sends POST `/api/claude/run`.

Impact

A process able to reach the configured server can submit prompts that direct Claude to act within the repository root or registered Git worktrees.

Mechanism

Unauthenticated local HTTP-triggered Claude CLI execution with default bypassed permissions.

Rationale

The source shows a real, explicit-user-invoked agent-execution capability with permissive defaults, but not concrete malicious behavior. Downgrade to warn for dangerous dual-use exposure rather than block publication.

Evidence

package.jsondist/index.jsdist/cli/index.jsdist/cli/commands/serve.jsdist/core/claude.jsdist/core/worktree.jsdist/core/storage.jsdist/core/notifier.js./.tkxr-server./tkxr/tickets./tkxr/comments./tkxr/sprints.json./tkxr/users.json

Network endpoints1

/api/claude/run

@legdev/tkxr@2.1.4

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code