registry / @netnodeag/kraftwerk / 0.78.0
@netnodeag/kraftwerk@0.78.0
⚠ Under reviewOpen-source agentic workspace for teams — where people and AI agents get work done together: agents (Claude Code, Codex, Pi), skills, shared knowledge, repeatable workflows, and deterministic verification
AI Security Review
scanned 17d ago · by lpm-firewall-aiThe inspected code shows no concrete attack, and the agent skill location is a per-agent content store reached through an API route. I cannot mark the package clean because generated bundles and runtime files remain unresolved after attempted source inspection; the scanner hints alone do not establish malicious behavior.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
No malicious trigger was confirmed in the inspected excerpts.
Impact
No concrete malicious impact was established; the unresolved source prevents a clean determination.
Mechanism
Inspected behavior includes user-facing workflow, workspace, event, and agent-skill operations; remaining flagged source behavior is unresolved.
AI rationale
The inspected code shows no concrete attack, and the agent skill location is a per-agent content store reached through an API route. I cannot mark the package clean because generated bundles and runtime files remain unresolved after attempted source inspection; the scanner hints alone do not establish malicious behavior.
Decision evidence
public snapshotAI called this Manual Review at 63.0% confidence as Unknown with medium false-positive risk.
AI review observations
- The manifest’s only lifecycle-related script is prepublishOnly, which builds the package; it declares no install hook.
- The indicated skill code scans project and user skill directories, while saving skills writes supplied content under an agent-specific skills path through the agents API route.
- The live client constructs event URLs for chat or vibeable topics, and listRuns reads workflow run directories.
- The inspected Git, shell, loopback HTTP, and npx operations support remote workspace resolution, configured development servers, daemon status, and workflow launches.
- The required review remains inconclusive: generated browser bundles and multiple runtime files have unresolved scanner analysis limits, without source evidence establishing an attack.
Evidence against
- No install-time attack or confirmed malicious effect was established in the inspected excerpts.
- The indicated skill save path is exposed through an API route and writes supplied skill content; the inspected source does not establish an unconsented global agent configuration change.
Behavioral surface
Source & flagged code
10 flaggeddist/remote.jsView file
1import { spawnSync } from "node:child_process";
L2: import { mkdir, stat } from "node:fs/promises";
High
dist/core/vibeables.jsView file
352cwd: r.dir,
L353: shell: true,
L354: detached: process.platform !== "win32",
High
bin/kraftwerk.jsView file
15if (existsSync(src) && process.env.KRAFTWERK_DIST !== "1") {
L16: const { register } = await import("tsx/esm/api");
L17: register();
Findings
1 Critical6 High5 Medium7 Low
CriticalTrojan Source Unicodeweb/dist/assets/editor-DHAdW1g_.js
HighChild Processdist/remote.js
HighShelldist/core/vibeables.js
HighSame File Env Network Executiondist/cli/daemon-control.js
HighCommand Output Exfiltrationdist/cli/daemon-control.js
HighRuntime Package Installdist/core/runner.js
HighSemantic Analysis Limiteddist/cli/daemon-control.js
MediumDynamic Requirebin/kraftwerk.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/cli/daemon-login.js
MediumStructural Risk Force Deep Review
Low
Affected versions and remediation
This report applies to @netnodeag/kraftwerk@0.78.0.
See all versions of @netnodeag/kraftwerk for other recorded verdicts.
- Review the evidence and your use of @netnodeag/kraftwerk@0.78.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.