registry / @netnodeag/kraftwerk / 0.74.0
@netnodeag/kraftwerk@0.74.0
Open-source agentic workspace for teams — where people and AI agents get work done together: agents (Claude Code, Codex, Pi), skills, shared knowledge, repeatable workflows, and deterministic verification
AI Security Review
scanned 17d ago · by lpm-firewall-aiSource inspection found no install hook; the only lifecycle script shown is prepublishOnly, which runs build commands. The agent skill location is a read path, and skill creation is routed through an explicit API operation; scanner indicators alone do not establish an attack.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Using the CLI, client APIs, or agent skill API.
Impact
No unauthorized credential transfer, persistence, destructive behavior, or unconsented agent control-surface change was established.
Mechanism
The inspected code reads workspace run data, builds event URLs from the configured client base, resolves a supplied repository, and handles agent skill files through an API route.
AI rationale
Source inspection found no install hook; the only lifecycle script shown is prepublishOnly, which runs build commands. The agent skill location is a read path, and skill creation is routed through an explicit API operation; scanner indicators alone do not establish an attack.
Decision evidence
public snapshotAI called this Clean at 84.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json has no install lifecycle hook; prepublishOnly runs build commands.
- The skills location scans project and user .claude skill folders; saving a skill is exposed through an explicit POST API and writes a validated skill name.
- The live client builds event URLs from the configured client base, and run listing reads the configured output directory.
- The editor bundle contains zero-width-space and Unicode character handling; the entry bundle references editor and editor-library assets.
- Remote repository resolution clones or refreshes the supplied repository spec into a Kraftwerk cache.
- The inspected daemon and runner code describe user-invoked daemon and workflow operations.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket
HighEntropyStrings
Source & flagged code
10 flaggeddist/remote.jsView file
1import { spawnSync } from "node:child_process";
L2: import { mkdir, stat } from "node:fs/promises";
High
dist/core/vibeables.jsView file
352cwd: r.dir,
L353: shell: true,
L354: detached: process.platform !== "win32",
High
bin/kraftwerk.jsView file
15if (existsSync(src) && process.env.KRAFTWERK_DIST !== "1") {
L16: const { register } = await import("tsx/esm/api");
L17: register();
Findings
1 Critical6 High5 Medium7 Low
CriticalTrojan Source Unicodeweb/dist/assets/editor-ByOSpxTX.js
HighChild Processdist/remote.js
HighShelldist/core/vibeables.js
HighSame File Env Network Executiondist/cli/daemon-control.js
HighCommand Output Exfiltrationdist/cli/daemon-control.js
HighRuntime Package Installdist/core/runner.js
HighSemantic Analysis Limiteddist/cli/daemon-control.js
MediumDynamic Requirebin/kraftwerk.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/cli/daemon-login.js
MediumStructural Risk Force Deep Review
Low
Affected versions and remediation
This report applies to @netnodeag/kraftwerk@0.74.0.
See all versions of @netnodeag/kraftwerk for other recorded verdicts.
- Review the evidence and your use of @netnodeag/kraftwerk@0.74.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.