registry / @netnodeag/kraftwerk / 0.75.0
@netnodeag/kraftwerk@0.75.0
Open-source agentic workspace for teams — where people and AI agents get work done together: agents (Claude Code, Codex, Pi), skills, shared knowledge, repeatable workflows, and deterministic verification
AI Security Review
scanned 17d ago · by lpm-firewall-aiSource inspection resolves the cited indicators as workspace behavior: the package has no install-time hook, skill writes are agent-scoped, and reviewed process launches require an API or CLI action. I found no concrete attack behavior in the inspected paths.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A user invokes a workflow, starts a configured dev server, or runs a daemon command.
Impact
No malicious effect was established in these paths.
Mechanism
The package writes agent skills within an agent-specific directory and launches the requested workflow or configured development command.
AI rationale
Source inspection resolves the cited indicators as workspace behavior: the package has no install-time hook, skill writes are agent-scoped, and reviewed process launches require an API or CLI action. I found no concrete attack behavior in the inspected paths.
Decision evidence
public snapshotAI called this Clean at 90.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest has no install hook; its prepublishOnly script runs build steps.
- Skill discovery reads project and user skills, while saving a skill writes under one agent’s skills directory through a POST route.
- The live client builds event URLs through its configured client; run listing reads local output directories.
- The inspected bundle excerpts use invisible characters in editor text handling and match control characters; they show no executable attack behavior.
- Remote workflow cloning is selected with the CLI’s --from option.
- Reviewed process launches are reached through explicit workflow or dev-server POST routes, or a daemon start command.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket
HighEntropyStringsMinified
Source & flagged code
10 flaggeddist/remote.jsView file
1import { spawnSync } from "node:child_process";
L2: import { mkdir, stat } from "node:fs/promises";
High
dist/core/vibeables.jsView file
352cwd: r.dir,
L353: shell: true,
L354: detached: process.platform !== "win32",
High
bin/kraftwerk.jsView file
15if (existsSync(src) && process.env.KRAFTWERK_DIST !== "1") {
L16: const { register } = await import("tsx/esm/api");
L17: register();
Findings
1 Critical6 High5 Medium7 Low
CriticalTrojan Source Unicodeweb/dist/assets/editor-DEb8z5-Q.js
HighChild Processdist/remote.js
HighShelldist/core/vibeables.js
HighSame File Env Network Executiondist/cli/daemon-control.js
HighCommand Output Exfiltrationdist/cli/daemon-control.js
HighRuntime Package Installdist/core/runner.js
HighSemantic Analysis Limiteddist/cli/daemon-control.js
MediumDynamic Requirebin/kraftwerk.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/cli/daemon-login.js
MediumStructural Risk Force Deep Review
Low
Affected versions and remediation
This report applies to @netnodeag/kraftwerk@0.75.0.
See all versions of @netnodeag/kraftwerk for other recorded verdicts.
- Review the evidence and your use of @netnodeag/kraftwerk@0.75.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.