registry / @netnodeag/kraftwerk / 0.71.0
@netnodeag/kraftwerk@0.71.0
Open-source agentic workspace for teams — where people and AI agents get work done together: agents (Claude Code, Codex, Pi), skills, shared knowledge, repeatable workflows, and deterministic verification
AI Security Review
scanned 17d ago · by lpm-firewall-aiSource inspection found no malicious install hook or concrete attack chain. The scanner’s Unicode match occurs in bundled editor text-handling code, while the process and persistence behavior belongs to explicit application operations.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Use of the application’s runtime features or explicit daemon-install command.
Impact
No malicious effect was established from these behaviors.
Mechanism
The reviewed code handles workspace skills and runs, loads bundled editor assets, and installs a macOS login item only when its install command is invoked.
AI rationale
Source inspection found no malicious install hook or concrete attack chain. The scanner’s Unicode match occurs in bundled editor text-handling code, while the process and persistence behavior belongs to explicit application operations.
Decision evidence
public snapshotAI called this Clean at 88.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest defines `prepublishOnly` for build steps; it has no `preinstall`, `install` or `postinstall` hook.
- The agent-skill listing reads project and user skill directories; its write API is exposed through an explicit POST route.
- Live client requests use the configured client base and named event routes; run listing reads run directories under the configured output folder.
- The flagged Unicode ranges appear in editor and bundled editor code, consistent with text handling in the shipped web assets.
- Remote cloning, workflow launch and daemon persistence are exposed as application operations; daemon persistence requires the explicit install command.
Evidence against
- The inspected source does not establish install-time execution, credential disclosure, unconsented agent configuration changes or another concrete attack.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork
Source & flagged code
8 flaggeddist/remote.jsView file
1import { spawnSync } from "node:child_process";
L2: import { mkdir, stat } from "node:fs/promises";
High
dist/core/vibeables.jsView file
352cwd: r.dir,
L353: shell: true,
L354: detached: process.platform !== "win32",
High
bin/kraftwerk.jsView file
15if (existsSync(src) && process.env.KRAFTWERK_DIST !== "1") {
L16: const { register } = await import("tsx/esm/api");
L17: register();
Findings
1 Critical4 High5 Medium7 Low
CriticalTrojan Source Unicodeweb/dist/assets/editor-B3am-j9U.js
HighChild Processdist/remote.js
HighShelldist/core/vibeables.js
HighRuntime Package Installdist/core/runner.js
HighSemantic Analysis Limiteddist/cli/daemon-login.js
MediumDynamic Requirebin/kraftwerk.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/cli/daemon-login.js
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEval
LowWeak Cryptodist/core/instances.js
Affected versions and remediation
This report applies to @netnodeag/kraftwerk@0.71.0.
See all versions of @netnodeag/kraftwerk for other recorded verdicts.
- Review the evidence and your use of @netnodeag/kraftwerk@0.71.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.