@punks/cli@3.1.10
Harness Intelligence scaffolding CLI
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThe static malicious label is not supported by the inspected source. The remaining risk is explicit-user-command agent configuration and hook execution, which warrants a warning rather than a block.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
User invokes a hi/hint scaffold or related setup command; generated hooks run later in that project’s agent lifecycle.
Impact
Project agent sessions may execute the installed local hook commands and modify eligible edited source files.
Mechanism
User-invoked AI-agent hook/configuration projection with local formatter commands.
AI rationale
The static malicious label is not supported by the inspected source. The remaining risk is explicit-user-command agent configuration and hook execution, which warrants a warning rather than a block.
Evidence
package.jsondist/index.jsdist/data/hooks/format-edited-file.mjsdist/data/hooks/scaffold-update-check.mjs.claude/settings.json.claude/hooks/format-edited-file.mjs.codex/config.toml.codex/hooks/format-edited-file.mjs.cursor/hooks.json.cursor/hooks/format-edited-file.mjs.opencode/plugins/format-edited-file.mjs.devpunks/scaffold-manifest.json
Network endpoints1
registry.npmjs.org
Decision evidence
public snapshotAI called this Suspicious at 87.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Explicit CLI scaffolding projects hooks into .claude, .codex, .cursor, and .opencode configs (dist/index.js).
- Projected format hook runs local git, formatter, linter, and Node worker commands on edited project files (dist/data/hooks/format-edited-file.mjs).
- Startup scaffold-check hook invokes local hi/hint check and forwards its output to agent harnesses (dist/data/hooks/scaffold-update-check.mjs).
Evidence against
- package.json contains only bin entrypoints; it has no npm lifecycle scripts.
- Entrypoint behavior requires invoking hi/hint; no import-time or install-time execution is declared.
- Registry fetch is an update/version check to registry.npmjs.org; no credential harvesting or arbitrary exfiltration was found.
- The --eval use is a fixed embedded atomic file-publication worker, not decoded remote payload execution.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
Source & flagged code
10 flaggeddist/index.jsView file
155`)+1;while(nl!==0){this.onNewLine(this.offset+nl);nl=this.source.indexOf(`
L156: `,nl)+1}}return{type,offset:this.offset,indent:this.indent,source:this.source}}startBlockValue(parent){switch(this.type){case"alias":case"scalar":case"single-quoted-scalar":case"do...
L157: `+ind(d+1));return`[
High
151`)return yield*this.pushCount(1);else if(ch==="\r"&&this.charAt(1)===`
L152: `)return yield*this.pushCount(2);else return 0}*pushSpaces(allowTabs){let i=this.pos-1;let ch;do{ch=this.buffer[++i]}while(ch===" "||allowTabs&&ch==="\t");const n=i-this.pos;if(n>0...
L153: `)+1;while(nl!==0){this.onNewLine(this.offset+nl);nl=this.source.indexOf(`
...
L155: `)+1;while(nl!==0){this.onNewLine(this.offset+nl);nl=this.source.indexOf(`
L156: `,nl)+1}}return{type,offset:this.offset,indent:this.indent,source:this.source}}startBlockValue(parent){switch(this.type){case"alias":case"scalar":case"single-quoted-scalar":case"do...
L157: `+ind(d+1));return`[
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/index.jsView on unpkg · L151247${annotate2("Wizard cancelled.",red)}`;var renderCommandBlock=(label,commandLine,commandColor,labelColor=white)=>{const lines2=wrapCommand(commandLine);return[annotate2(label,bold,...
L248: `)};var wrapCommand=(commandLine)=>{const width=88;const firstIndent=" $ ";const continuationIndent=" ";const args2=commandLine.map(formatShellArg);const lines2=[];let current=...
L249: `]);var ESCAPE_LENGTH={x:3,u:5};var splitByWhitespaces=(template,rawTemplate)=>{if(rawTemplate.length===0){return{tokens:[],hasLeadingWhitespace:false,hasTrailingWhitespace:false}}...
L250: `){templateIndex-=1;rawIndex+=1}else if(nextRawCharacter==="u"&&rawTemplate[rawIndex+2]==="{"){rawIndex=rawTemplate.indexOf("}",rawIndex+3)}else{rawIndex+=ESCAPE_LENGTH[nextRawChar...
L251: `).map((line)=>line.trim()).filter
Findings
1 Critical7 High7 Medium4 Low
CriticalPrevious Version Dangerous Deltadist/data/hooks/format-edited-file.mjs
HighChild Processdist/index.js
HighShell
HighSame File Env Network Executiondist/index.js
HighCommand Output Exfiltrationdist/index.js
HighObfuscated Payload Loaderdist/index.js
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/index.js
HighTrigger Reachable Command Output Exfiltrationdist/index.js
MediumDynamic Requiredist/index.js
MediumUnsafe Vm Contextdist/index.js
MediumNetwork
MediumEnvironment Vars
MediumProtestware
Affected versions and remediation
This report applies to @punks/cli@3.1.10.
See all versions of @punks/cli for other recorded verdicts.
- Review the evidence and your use of @punks/cli@3.1.10 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.