registry / @netnodeag/kraftwerk / 0.79.0
@netnodeag/kraftwerk@0.79.0
⚠ Under reviewOpen-source agentic workspace for teams — where people and AI agents get work done together: agents (Claude Code, Codex, Pi), skills, shared knowledge, repeatable workflows, and deterministic verification
AI Security Review
scanned 17d ago · by lpm-firewall-aiThe inspected excerpts show ordinary agent-skill, event, run, and configured-command behavior, but they do not resolve the package’s full runtime surface. No concrete attack is established, so the source does not support either a clean verdict or a malicious finding.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
No malicious trigger was established in the inspected paths.
Impact
No concrete attack impact was confirmed.
Mechanism
The inspected code covers agent skill storage, event handling, local run listing, configured commands, and bundled editor code; these excerpts do not establish unauthorized behavior.
AI rationale
The inspected excerpts show ordinary agent-skill, event, run, and configured-command behavior, but they do not resolve the package’s full runtime surface. No concrete attack is established, so the source does not support either a clean verdict or a malicious finding.
Evidence
package.jsondist/core/skills.jsdist/server/api/agents.jsdist/client/live.jsdist/core/runs.jsdist/remote.jsdist/core/vibeables.jsdist/cli/daemon-control.jsdist/core/runner.jsweb/dist/assets/editor-BQlHN7qT.jsweb/dist/assets/index-C7ddpWNC.jsweb/dist/assets/dist-CYzOYk_e.js
Decision evidence
public snapshotAI called this Manual Review at 47.0% confidence as Unknown with medium false-positive risk.
AI review observations
- The manifest defines a prepublishOnly build command.
- The required skill location reads project and user skill directories during discovery.
- Saving an agent skill writes the submitted content under that agent’s own skills directory through a POST route.
- The inspected client and run-list code handles chat or vibeable events and local run records.
- Remote resolution accepts a repository specification, and vibeable startup uses its configured development command.
- The inspected daemon, workflow, and bundled editor excerpts do not establish an attack; package-wide runtime behavior remains unresolved.
Evidence against
- The package includes code that launches configured project commands and workflow runs; the inspected callers do not establish that these are unauthorized.
- The inspected excerpts do not resolve all runtime behavior across the package.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystem
Source & flagged code
10 flaggeddist/remote.jsView file
1import { spawnSync } from "node:child_process";
L2: import { mkdir, stat } from "node:fs/promises";
High
dist/core/vibeables.jsView file
352cwd: r.dir,
L353: shell: true,
L354: detached: process.platform !== "win32",
High
bin/kraftwerk.jsView file
15if (existsSync(src) && process.env.KRAFTWERK_DIST !== "1") {
L16: const { register } = await import("tsx/esm/api");
L17: register();
Findings
1 Critical6 High5 Medium7 Low
CriticalTrojan Source Unicodeweb/dist/assets/editor-BQlHN7qT.js
HighChild Processdist/remote.js
HighShelldist/core/vibeables.js
HighSame File Env Network Executiondist/cli/daemon-control.js
HighCommand Output Exfiltrationdist/cli/daemon-control.js
HighRuntime Package Installdist/core/runner.js
HighSemantic Analysis Limiteddist/cli/daemon-control.js
MediumDynamic Requirebin/kraftwerk.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/cli/daemon-login.js
MediumStructural Risk Force Deep Review
Low
Affected versions and remediation
This report applies to @netnodeag/kraftwerk@0.79.0.
See all versions of @netnodeag/kraftwerk for other recorded verdicts.
- Review the evidence and your use of @netnodeag/kraftwerk@0.79.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.