registry / @netnodeag/kraftwerk / 0.12.0
@netnodeag/kraftwerk@0.12.0
Deterministic workflow-as-code framework: agents (persona + model + tools + harness) run in bounded phases on headless CLI harnesses (claude -p, codex exec, pi); code owns the control flow, envelopes + gates judge the results
AI Security Review
scanned 17d ago · by lpm-firewall-aiThe manifest has no install-time lifecycle hook; its prepublishOnly script runs build steps. Inspected process, network, and file operations are consistent with user-triggered workflow and inspector features, with no concrete attack behavior found.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Users invoke the CLI, create an inspector chat, or request a sandboxed workflow run.
Impact
These inspected operations do not establish credential theft, covert data transfer, or unauthorized system modification.
Mechanism
The package resolves a supplied remote spec, starts requested runs, records chat metadata, and provides a Docker image build operation.
AI rationale
The manifest has no install-time lifecycle hook; its prepublishOnly script runs build steps. Inspected process, network, and file operations are consistent with user-triggered workflow and inspector features, with no concrete attack behavior found.
Decision evidence
public snapshotAI called this Clean at 90.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json defines prepublishOnly as build steps; it does not define an install hook.
- The inspector uses a relative API request when creating a chat.
- Remote workflow resolution uses the supplied spec and stores the result in a Kraftwerk cache.
- Inspector run setup creates a run directory and log for the requested workflow.
- Chat creation stores metadata for the selected scope and working directory.
- Docker image building is an explicit function in the runner module.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsMinifiedPossibleObfuscationTelemetryUrlStrings
Source & flagged code
5 flaggeddist/remote.jsView file
1import { spawnSync } from "node:child_process";
L2: import { mkdir, stat } from "node:fs/promises";
High
bin/kraftwerk.jsView file
15if (existsSync(src) && process.env.KRAFTWERK_DIST !== "1") {
L16: const { register } = await import("tsx/esm/api");
L17: register();
Medium
Dynamic Require
Package source references dynamic require/import behavior.
bin/kraftwerk.jsView on unpkg · L15dist/inspector/runner.jsView file
1import { spawn, spawnSync } from "node:child_process";
L2: import { mkdirSync, openSync, closeSync } from "node:fs";
...
L8: * Workflow trigger for the web UI. The inspector stays decoupled from the
L9: * framework runtime: it shells out to `npx kraftwerk run` in the consumer
L10: * project, detached, with a pre-chosen --run-id so the browser can jump to
Findings
1 Critical4 High4 Medium6 Low
CriticalPrevious Version Dangerous Deltadist/runner/docker.js
HighChild Processdist/remote.js
HighShell
HighRuntime Package Installdist/inspector/runner.js
HighSemantic Analysis Limiteddist/inspector/chat/sessions.js
MediumDynamic Requirebin/kraftwerk.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to @netnodeag/kraftwerk@0.12.0.
See all versions of @netnodeag/kraftwerk for other recorded verdicts.
- Review the evidence and your use of @netnodeag/kraftwerk@0.12.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.