registry / @netnodeag/kraftwerk / 0.56.1
@netnodeag/kraftwerk@0.56.1
Open-source agentic workspace for teams — where people and AI agents get work done together: agents (Claude Code, Codex, Pi), skills, shared knowledge, repeatable workflows, and deterministic verification
AI Security Review
scanned 17d ago · by lpm-firewall-aiSource inspection found no install lifecycle hook or concrete attack behavior. The scanner’s execution and network matches correspond to user-invoked CLI and inspector functionality, and the skill write is exposed through product functionality.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Users invoke the CLI or inspector features that list or save skills, launch workflows, access configured repositories or start a configured tunnel.
Impact
No unconsented install-time mutation, credential disclosure or other concrete attack effect was established.
Mechanism
These operations read local workspace data, write a specifically named skill, launch a workflow process, or use project-provided repository and tunnel settings.
AI rationale
Source inspection found no install lifecycle hook or concrete attack behavior. The scanner’s execution and network matches correspond to user-invoked CLI and inspector functionality, and the skill write is exposed through product functionality.
Decision evidence
public snapshotAI called this Clean at 83.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json defines a prepublishOnly build script but no install, preinstall or postinstall hook.
- The skill listing code reads project and user skill directories; its save helper writes one named skill, and the server calls it through an API handler.
- The run listing code enumerates local workflow output directories; it does not perform account actions or transmit credentials.
- The inspected bundled assets contain editor and interface code; no attack behavior was established from them.
- Remote repository access runs git operations for a supplied repository specification; tunnel startup depends on project tunnel settings.
- Inspector run launching and workspace registration support explicit product operations, while the executable shim selects the package CLI entrypoint.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
Source & flagged code
8 flaggeddist/remote.jsView file
1import { spawnSync } from "node:child_process";
L2: import { mkdir, stat } from "node:fs/promises";
High
dist/inspector/vibeables.jsView file
546cwd: r.dir,
L547: shell: true,
L548: detached: process.platform !== "win32",
High
bin/kraftwerk.jsView file
15if (existsSync(src) && process.env.KRAFTWERK_DIST !== "1") {
L16: const { register } = await import("tsx/esm/api");
L17: register();
Findings
2 Critical4 High4 Medium7 Low
CriticalTrojan Source Unicodeinspector/dist/assets/editor-DMHihW2Y.js
CriticalPrevious Version Dangerous Deltadist/inspector/instances.js
HighChild Processdist/remote.js
HighShelldist/inspector/vibeables.js
HighRuntime Package Installdist/inspector/runner.js
HighSemantic Analysis Limiteddist/cli/tunnel.js#virtual:normalized:round1
MediumDynamic Requirebin/kraftwerk.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEval
Low
Affected versions and remediation
This report applies to @netnodeag/kraftwerk@0.56.1.
See all versions of @netnodeag/kraftwerk for other recorded verdicts.
- Review the evidence and your use of @netnodeag/kraftwerk@0.56.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.