registry / @punks/cli / 5.1.0
@punks/cli@5.1.0
⚠ Under reviewHarness Intelligence scaffolding CLI
AI Security Review
scanned 1mo ago · by lpm-firewall-aiReadable sources are a user-invoked CLI without an install hook or a confirmed exfiltration path. The required baseline archive is binary and could not be cited, so the review cannot be closed as clean.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
The CLI runs when hi or hint is executed. The timesheet and commit-gate scripts run only if invoked separately.
Impact
No confirmed install-time compromise was found in readable sources. The unread binary archive leaves a coverage gap rather than a demonstrated effect.
Mechanism
Install metadata does not execute code. The main module starts the CLI, and the two scripts call git or a contract shell command when launched.
AI rationale
Readable sources are a user-invoked CLI without an install hook or a confirmed exfiltration path. The required baseline archive is binary and could not be cited, so the review cannot be closed as clean.
Decision evidence
public snapshotAI called this Manual Review at 58.0% confidence as Unknown with medium false-positive risk.
AI review observations
- package.json maps the hi and hint bins to dist/index.js and defines no preinstall, install, or postinstall script.
- dist/index.js starts the CLI only when the file is the main module.
- git-timesheet-evidence.mjs is a standalone script that calls git through execFileSync for local commit evidence.
- commit-gate-runner.mjs runs contract-supplied lint commands with sh only after it is invoked with --contracts.
- dist/baseline/scaffold-baseline.tgz is binary; no 12-byte printable excerpt could be cited after multiple reads.
Evidence against
- No credential send, remote payload fetch, or automatic agent-config write appears in the readable entrypoint.
- Shell use in the timesheet and commit-gate scripts is reached only when those scripts are run, not during package install.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStrings
Source & flagged code
12 flaggeddist/baseline/scaffold-baseline/skills/misc/timesheet/scripts/git-timesheet-evidence.mjsView file
1#!/usr/bin/env node
L2: import { execFileSync } from "node:child_process";
L3: import { existsSync, readdirSync, statSync } from "node:fs";
High
Child Process
Package source references child process execution.
dist/baseline/scaffold-baseline/skills/misc/timesheet/scripts/git-timesheet-evidence.mjsView on unpkg · L1dist/index.jsView file
151`)return yield*this.pushCount(1);else if(ch==="\r"&&this.charAt(1)===`
L152: `)return yield*this.pushCount(2);else return 0}*pushSpaces(allowTabs){let i=this.pos-1;let ch;do{ch=this.buffer[++i]}while(ch===" "||allowTabs&&ch==="\t");const n=i-this.pos;if(n>0...
L153: `)+1;while(nl!==0){this.onNewLine(this.offset+nl);nl=this.source.indexOf(`
...
L155: `)+1;while(nl!==0){this.onNewLine(this.offset+nl);nl=this.source.indexOf(`
L156: `,nl)+1}}return{type,offset:this.offset,indent:this.indent,source:this.source}}startBlockValue(parent){switch(this.type){case"alias":case"scalar":case"single-quoted-scalar":case"do...
L157: `+ind(d+1));return`[
High
Findings
1 Critical8 High7 Medium6 Low
CriticalPrevious Version Dangerous Deltadist/baseline/scaffold-baseline/data/scripts/commit-gate-runner.mjs
HighChild Processdist/baseline/scaffold-baseline/skills/misc/timesheet/scripts/git-timesheet-evidence.mjs
HighShell
HighSame File Env Network Executiondist/index.js
HighCredential Redirect Persistencedist/index.js
HighCommand Output Exfiltrationdist/index.js
HighObfuscated Payload Loaderdist/index.js
HighTrigger Reachable Command Output Exfiltrationdist/index.js
HighShips High Entropy Blobdist/baseline/scaffold-baseline.tgz
MediumUnsafe Vm Contextdist/index.js
MediumNetwork
Affected versions and remediation
This report applies to @punks/cli@5.1.0.
See all versions of @punks/cli for other recorded verdicts.
- Review the evidence and your use of @punks/cli@5.1.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.