registry / @punks/cli / 3.1.5
@punks/cli@3.1.5
Harness Intelligence scaffolding CLI
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThis is a first-party agent-extension/scaffolding capability with meaningful user-invoked project mutation, so it merits a warning classification. Source inspection found no lifecycle-triggered or stealthy malicious behavior.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
User runs `hi scaffold`, `hi update --yes`, `hi tools ensure`, `hi operator ...`, or `hi report`.
Impact
Can alter selected project agent-skill homes and install configured tools when the user invokes those commands.
Mechanism
User-invoked agent scaffold projection, tool bootstrap, and control-plane API client.
AI rationale
This is a first-party agent-extension/scaffolding capability with meaningful user-invoked project mutation, so it merits a warning classification. Source inspection found no lifecycle-triggered or stealthy malicious behavior.
Evidence
package.jsondist/index.jsdist/data/control-plane.jsondist/skills/agnostic/frontend/agent-browser/templates/authenticated-session.sh.agents/skills.claude/skills.codex/skills.cursor/skills.devpunks/
Network endpoints2
harness-intelligence-api.vercel.appregistry.npmjs.org
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- `hi scaffold`/`hi update --yes` copy managed agent skills and settings into the selected project.
- Explicit `hi tools ensure` and scaffold/update bootstrap invoke package-manager child processes.
- The CLI sends opted/configured control-plane telemetry and explicit `hi report` payloads.
Evidence against
- `package.json` has no preinstall, install, or postinstall lifecycle hook.
- Writes occur only through invoked CLI scaffold/update/operator commands and use confined-path checks.
- The bundled auth shell template exits before its commented credential-login flow; it does not harvest credentials.
- No source evidence of hidden payload execution, unsolicited exfiltration, or install-time mutation.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsMinified
Source & flagged code
11 flaggeddist/index.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @punks/cli@3.1.3
matchedIdentity = npm:QHB1bmtzL2NsaQ:3.1.3
similarity = 0.953
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/index.jsView on unpkg155`)+1;while(nl!==0){this.onNewLine(this.offset+nl);nl=this.source.indexOf(`
L156: `,nl)+1}}return{type,offset:this.offset,indent:this.indent,source:this.source}}startBlockValue(parent){switch(this.type){case"alias":case"scalar":case"single-quoted-scalar":case"do...
L157: `+ind(d+1));return`[
High
151`)return yield*this.pushCount(1);else if(ch==="\r"&&this.charAt(1)===`
L152: `)return yield*this.pushCount(2);else return 0}*pushSpaces(allowTabs){let i=this.pos-1;let ch;do{ch=this.buffer[++i]}while(ch===" "||allowTabs&&ch==="\t");const n=i-this.pos;if(n>0...
L153: `)+1;while(nl!==0){this.onNewLine(this.offset+nl);nl=this.source.indexOf(`
...
L155: `)+1;while(nl!==0){this.onNewLine(this.offset+nl);nl=this.source.indexOf(`
L156: `,nl)+1}}return{type,offset:this.offset,indent:this.indent,source:this.source}}startBlockValue(parent){switch(this.type){case"alias":case"scalar":case"single-quoted-scalar":case"do...
L157: `+ind(d+1));return`[
Findings
1 Critical7 High9 Medium6 Low
CriticalPrevious Version Dangerous Deltadist/index.js
HighChild Processdist/index.js
HighShell
HighSame File Env Network Executiondist/index.js
HighCommand Output Exfiltrationdist/index.js
HighObfuscated Payload Loaderdist/index.js
HighTrigger Reachable Command Output Exfiltrationdist/index.js
HighTrigger Reachable Persistencedist/index.js
MediumDynamic Requiredist/index.js
MediumUnsafe Vm Contextdist/index.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/index.js
Affected versions and remediation
This report applies to @punks/cli@3.1.5.
See all versions of @punks/cli for other recorded verdicts.
- Review the evidence and your use of @punks/cli@3.1.5 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.