@punks/cli@3.1.4
Harness Intelligence scaffolding CLI
AI Security Review
scanned 3mo ago · by lpm-firewall-aiNot malicious: source inspection shows an opt-in scaffolding CLI with no lifecycle hook or concrete covert attack chain. Warn because explicit commands can configure multiple AI-agent control surfaces and install a managed hook.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Explicit hi scaffold, hi update, or hi operator command.
Impact
Can alter AI-agent behavior within the chosen repository after a user runs the command.
Mechanism
project-scoped agent scaffold and verified baseline/skill retrieval
AI rationale
Not malicious: source inspection shows an opt-in scaffolding CLI with no lifecycle hook or concrete covert attack chain. Warn because explicit commands can configure multiple AI-agent control surfaces and install a managed hook.
Evidence
package.jsondist/index.jsdist/baseline/scaffold-baseline.jsondist/baseline/scaffold-baseline/skills/misc/timesheet/scripts/git-timesheet-evidence.mjsdist/baseline/scaffold-baseline/skills/frameworks/expo/expo-ui/scripts/list-components.jsdist/baseline/scaffold-baseline.tgz.claude/settings.json.codex/config.toml.cursor/hooks.jsonopencode.json
Network endpoints2
github.com/wearedevpunks/skills.gitregistry.npmjs.org
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- Explicit CLI scaffold projects files into .claude, .codex, .cursor, and .opencode.
- Scaffold can create agent hooks/configuration, including .codex/config.toml.
- `hi operator` fetches a pinned skill source from GitHub and invokes the Skills CLI.
- Runtime can download a baseline archive after URL, redirect, and SHA-256 checks.
Evidence against
- package.json has no lifecycle scripts; execution is through hi/hint only.
- No credential harvesting, secret exfiltration, eval, or hidden payload execution found.
- Network use is command-scoped for baseline/operator updates, with validation and integrity verification.
- Bundled tgz is a baseline scaffold artifact with matching extracted contents.
- The highlighted git timesheet script is a separately invoked utility that prints local git evidence.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
Source & flagged code
14 flaggeddist/baseline/scaffold-baseline/skills/misc/timesheet/scripts/git-timesheet-evidence.mjsView file
1#!/usr/bin/env node
L2: import { execFileSync } from "node:child_process";
L3: import { existsSync, readdirSync, statSync } from "node:fs";
High
Child Process
Package source references child process execution.
dist/baseline/scaffold-baseline/skills/misc/timesheet/scripts/git-timesheet-evidence.mjsView on unpkg · L1dist/baseline/scaffold-baseline/skills/frameworks/expo/expo-ui/scripts/list-components.jsView file
15L16: const fs = require('fs');
L17: const path = require('path');
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/baseline/scaffold-baseline/skills/frameworks/expo/expo-ui/scripts/list-components.jsView on unpkg · L15Findings
1 Critical8 High9 Medium6 Low
CriticalPrevious Version Dangerous Deltadist/index.js
HighChild Processdist/baseline/scaffold-baseline/skills/misc/timesheet/scripts/git-timesheet-evidence.mjs
HighShell
HighSame File Env Network Executiondist/index.js
HighCommand Output Exfiltrationdist/index.js
HighObfuscated Payload Loaderdist/index.js
HighTrigger Reachable Command Output Exfiltrationdist/index.js
HighTrigger Reachable Persistencedist/index.js
HighShips High Entropy Blobdist/baseline/scaffold-baseline.tgz
MediumDynamic Requiredist/baseline/scaffold-baseline/skills/frameworks/expo/expo-ui/scripts/list-components.js
MediumUnsafe Vm Context
Affected versions and remediation
This report applies to @punks/cli@3.1.4.
See all versions of @punks/cli for other recorded verdicts.
- Review the evidence and your use of @punks/cli@3.1.4 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.