@punks/cli@3.2.1
Harness Intelligence scaffolding CLI
AI Security Review
scanned 3mo ago · by lpm-firewall-aiNot malicious: no npm install hook or concrete malicious chain was found. Warn because the explicit scaffold workflow mutates AI-agent control surfaces and registers command hooks.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
User runs the hi scaffold workflow.
Impact
Later agent sessions may run package-provided local hook scripts in the scaffolded project.
Mechanism
Project-local AI-agent hook and configuration projection.
AI rationale
Not malicious: no npm install hook or concrete malicious chain was found. Warn because the explicit scaffold workflow mutates AI-agent control surfaces and registers command hooks.
Evidence
package.jsondist/baseline/scaffold-baseline/data/scripts/harness-projection/adapters/codex.mjsdist/baseline/scaffold-baseline/data/scripts/harness-projection/adapters/claude.mjs.codex/config.toml.codex/hooks/format-edited-file.mjs.codex/hooks/scaffold-update-check.mjs.claude/settings.json.claude/hooks/format-edited-file.mjs.claude/hooks/scaffold-update-check.mjs
Decision evidence
public snapshotAI called this Suspicious at 93.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- Explicit scaffold projection configures project-local Codex command hooks.
- Claude projection mirrors hooks and merges project settings.
- Bundled scaffold can modify AI-agent control surfaces after a user runs its CLI.
Evidence against
- package.json exposes only bin entrypoints; no npm lifecycle hook is declared.
- Hook targets are project-local and named as formatting/scaffold-update checks.
- No credential harvesting, payload download, or exfiltration was confirmed.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsMinifiedPossibleObfuscationProtestwareUrlStrings
NoLicenseWildcardDependency
Source & flagged code
12 flaggeddist/baseline/scaffold-baseline/skills/misc/timesheet/scripts/git-timesheet-evidence.mjsView file
1#!/usr/bin/env node
L2: import { execFileSync } from "node:child_process";
L3: import { existsSync, readdirSync, statSync } from "node:fs";
High
Child Process
Package source references child process execution.
dist/baseline/scaffold-baseline/skills/misc/timesheet/scripts/git-timesheet-evidence.mjsView on unpkg · L1dist/baseline/scaffold-baseline/skills/frameworks/expo/expo-ui/scripts/list-components.jsView file
15L16: const fs = require("fs");
L17: const path = require("path");
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/baseline/scaffold-baseline/skills/frameworks/expo/expo-ui/scripts/list-components.jsView on unpkg · L15Findings
1 Critical7 High9 Medium6 Low
CriticalPrevious Version Dangerous Deltadist/baseline/scaffold-baseline/data/scripts/sync-subagents.native.test.ts
HighChild Processdist/baseline/scaffold-baseline/skills/misc/timesheet/scripts/git-timesheet-evidence.mjs
HighShell
HighSame File Env Network Executiondist/index.js
HighCommand Output Exfiltrationdist/index.js
HighObfuscated Payload Loaderdist/index.js
HighTrigger Reachable Command Output Exfiltrationdist/index.js
HighShips High Entropy Blobdist/baseline/scaffold-baseline.tgz
MediumDynamic Requiredist/baseline/scaffold-baseline/skills/frameworks/expo/expo-ui/scripts/list-components.js
MediumUnsafe Vm Contextdist/index.js
Affected versions and remediation
This report applies to @punks/cli@3.2.1.
See all versions of @punks/cli for other recorded verdicts.
- Review the evidence and your use of @punks/cli@3.2.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.