registry / @punks/cli / 3.1.3
@punks/cli@3.1.3
Harness Intelligence scaffolding CLI
AI Security Review
scanned 3mo ago · by lpm-firewall-aiSource inspection contradicts the scanner’s claimed hidden loader and command-output exfiltration. The package is not malicious, but its opt-in agent-extension installation capability warrants a warning under the stated policy.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
User runs `hi operator install`, `update`, or `migrate`; ordinary CLI invocation starts optional background checks.
Impact
User-invoked agent-extension configuration mutation; no confirmed credential or data exfiltration.
Mechanism
Explicit agent-skill lifecycle management plus self-update/status checks.
AI rationale
Source inspection contradicts the scanner’s claimed hidden loader and command-output exfiltration. The package is not malicious, but its opt-in agent-extension installation capability warrants a warning under the stated policy.
Evidence
package.jsondist/index.jsdist/baseline/scaffold-baseline/skills/misc/timesheet/scripts/git-timesheet-evidence.mjsdist/baseline/scaffold-baseline/skills/frameworks/expo/expo-ui/scripts/list-components.js~/.cache/hi/startup-check.json
Network endpoints2
registry.npmjs.orggithub.com/wearedevpunks/skills.git
Decision evidence
public snapshotAI called this Suspicious at 86.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- dist/index.js exposes explicit `hi operator install/update/migrate` skill mutations.
- Operator install fetches a pinned Git revision and invokes the external Skills CLI to install `hi-cli`.
- Normal CLI runs create `~/.cache/hi/startup-check.json` and may launch a detached status-check worker.
Evidence against
- package.json has no npm lifecycle scripts.
- No credential harvesting, arbitrary payload decoding, eval, or exfiltration path was found.
- Registry access only checks @punks/cli version at registry.npmjs.org; upgrade requires user confirmation.
- The bundled timesheet script only reads local Git metadata and prints it.
- Operator skill content is pinned by revision and SHA-256 manifest verification.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsMinified
Source & flagged code
14 flaggeddist/baseline/scaffold-baseline/skills/misc/timesheet/scripts/git-timesheet-evidence.mjsView file
1#!/usr/bin/env node
L2: import { execFileSync } from "node:child_process";
L3: import { existsSync, readdirSync, statSync } from "node:fs";
High
Child Process
Package source references child process execution.
dist/baseline/scaffold-baseline/skills/misc/timesheet/scripts/git-timesheet-evidence.mjsView on unpkg · L1dist/baseline/scaffold-baseline/skills/frameworks/expo/expo-ui/scripts/list-components.jsView file
15L16: const fs = require('fs');
L17: const path = require('path');
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/baseline/scaffold-baseline/skills/frameworks/expo/expo-ui/scripts/list-components.jsView on unpkg · L15Findings
1 Critical8 High9 Medium6 Low
CriticalPrevious Version Dangerous Deltadist/baseline/scaffold-baseline/data/scripts/sync-subagents.mjs
HighChild Processdist/baseline/scaffold-baseline/skills/misc/timesheet/scripts/git-timesheet-evidence.mjs
HighShell
HighSame File Env Network Executiondist/index.js
HighCommand Output Exfiltrationdist/index.js
HighObfuscated Payload Loaderdist/index.js
HighTrigger Reachable Command Output Exfiltrationdist/index.js
HighTrigger Reachable Persistencedist/index.js
HighShips High Entropy Blobdist/baseline/scaffold-baseline.tgz
MediumDynamic Requiredist/baseline/scaffold-baseline/skills/frameworks/expo/expo-ui/scripts/list-components.js
Affected versions and remediation
This report applies to @punks/cli@3.1.3.
See all versions of @punks/cli for other recorded verdicts.
- Review the evidence and your use of @punks/cli@3.1.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.