@promptctl/cc-candybar@1.168.0
Statusline renderer for Claude Code — a JSON5-configurable DSL with daemon-cached data sources, byte-clean palette-aware composition, and OSC8 click verbs.
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe statusline attach path silently enables a separate model-facing goal tool by forcing its feature gate on. This is an undisclosed agent capability change, so warn rather than block; the package has no install-time hook and the inspected behavior uses local sockets.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A user enables the statusline lane, which restarts an interactive Claude Code session under the attach launcher.
Impact
The model can use `ProposeGoal` to enqueue `/goal` actions even though the user chose statusline attachment, not this added model capability.
Mechanism
The launcher resolves and applies a source seam that forces the `tengu_propose_goal` feature gate to return true.
AI rationale
The statusline attach path silently enables a separate model-facing goal tool by forcing its feature gate on. This is an undisclosed agent capability change, so warn rather than block; the package has no install-time hook and the inspected behavior uses local sockets.
Evidence
dist/index.mjsdist/cc-extra/src/bun-attach.jsdist/cc-extra/src/seams.js${XDG_STATE_HOME:-~/.local/state}/cc-extra/attach.log<os.tmpdir()>/cc-extra-attach-*/inspector.sock
Network endpoints2
ws+unix://<os.tmpdir()>/cc-extra-attach-*/inspector.sock?wait=1unix:/tmp/cc-candybar-${uid}/socket
Decision evidence
public snapshotAI called this Suspicious at 98.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- The manifest exposes the CLI and lists `prepublishOnly`, with no install-time hook.
- Enabling the statusline lane restarts Claude Code under the attach launcher; the launcher resolves and applies the bundled `SEAMS` to the Claude Code module graph.
- One seam matches the `tengu_propose_goal` gate and inserts `return true;`; the source describes `ProposeGoal` as a model-accessible tool that enqueues `/goal`.
Evidence against
- The capability change is reached through the statusline attach path rather than an install hook.
- The inspected attach and statusline code uses local Unix sockets; no unrelated outbound destination was identified for this behavior.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedTelemetryUrlStrings
Source & flagged code
7 flaggeddist/index.mjsView file
10contains invisible/control Unicode U+200C (zero width non-joiner)
`:case`\r`:case`\u2028`:case`\u2029`:b(),p=`default`;return;case void 0:return b(),x(`eof`)}b()},value(){switch(_){case`{`:case`[`:return x(`punctuator`,b());case`n`:return b(),S(`ull`),x(`null`,null);case`t`:return b(),S(`rue`),x(`boolean`
Critical
Trojan Source Unicode
Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.
dist/index.mjsView on unpkg · L10485Trigger-reachable chain: scripts.start -> dist/index.mjs
L485: `)+1,a=0,o=0;for(let e of n.slice(r,i).split(`
L486: `)){let t=Zq(e);t.kind!==`blank`&&(a++,t.kind===`unparsed`&&o++)}return{lines:a,unparsed:o,whole:t}}function B4(e){let t=vo(e,nF+1);return t.kind===`ok`?P(z4(t.value.buf,t.value.fr...
L487: `)};return e.error===null?{...t,kind:`loaded`,unused:e.unused}:{...t,kind:`failed`,error:e.error}}const K4=e=>w4(()=>Ao(e));function q4(e,t){let n=e=>JSON.stringify([e.managedDir,e...
L488: `:null,r=s3(e.value);return r===null?{stdout:n??h3(e.value),stderr:``,code:0}:{stdout:n??``,stderr:`daemon-stats: ${r}\n`,code:1}}function o3(){return j(()=>({kind:`stats`}),r3,e=>...
...
L500: `).map(e=>e.trim().split(` `)).filter(([,e])=>e===t).map(([e])=>e)}const f7=/(^|\/)(cc-attach|bun-attach\.js)(
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/index.mjsView on unpkg · L485Findings
2 Critical4 High4 Medium6 Low
CriticalTrojan Source Unicodedist/index.mjs
CriticalTrigger Reachable Dangerous Capabilitydist/index.mjs
HighChild Processdist/index.mjs
HighSame File Env Network Executiondist/index.mjs
HighCommand Output Exfiltrationdist/index.mjs
HighTrigger Reachable Command Output Exfiltrationdist/index.mjs
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperplugin/bin/preview.sh
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to @promptctl/cc-candybar@1.168.0.
See all versions of @promptctl/cc-candybar for other recorded verdicts.
- Review the evidence and your use of @promptctl/cc-candybar@1.168.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.