registry / @taskless/cli-nightly / 0.11.1-20260905063821xcf5232d
@taskless/cli-nightly@0.11.1-20260905063821xcf5232d
Nightly build of [`@taskless/cli`](https://www.npmjs.com/package/@taskless/cli) — the same source and the same build, published from an unreleased commit on `main`.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package is not malicious by the inspected source, but it deliberately installs agent extensions and can execute runtime rule code. Policy classifies this first-party agent extension lifecycle capability as warn-level risk.
Static reason
One or more suspicious static signals were detected.
Trigger
A user runs taskless init or invokes runtime rule checking.
Impact
Project agent behavior can be changed and runtime rules can execute code in the project context.
Mechanism
AI-agent skill installation and dynamic runtime-rule import.
AI rationale
The package is not malicious by the inspected source, but it deliberately installs agent extensions and can execute runtime rule code. Policy classifies this first-party agent extension lifecycle capability as warn-level risk.
Evidence
dist/index.js.agents/skills.claude/skills.cursor/skills.opencode/skills.taskless/.env.local.json
Network endpoints2
app.taskless.io/cliz.taskless.io
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The user-invoked init command can install Taskless skills into detected Codex, Claude, Cursor, and OpenCode project control directories.
- The package contains a runtime-rule harness that dynamically imports and executes check.ts code.
- The CLI performs device-code authentication and sends telemetry to Taskless-owned endpoints.
Evidence against
- package.json has no preinstall, install, or postinstall hook.
- Agent-directory changes occur through the CLI init flow, not automatically at npm installation.
- Authentication requires browser device-code approval, and tokens are stored locally with mode 0600.
- No obfuscated loader, credential redirect, self-dependency, or install-time payload was confirmed.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShell
Source & flagged code
5 flaggeddist/index.jsView file
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/index.js:
import { mkdir as q, readFile as j, writeFile as P, rm as oe, readdir as fe, stat as $e, mkdtemp as Ia, copyFile as qu, glob as Vu, access as Wu, readlink as Ku, rename as Ta, cp a...
import { createReadStream as Ju, existsSync as di, readFileSync as Oa, globSync as Yu, mkdtempSync as Qu, writeFileSync as Xu, rmSync as Zu } from "node:fs";
import ef, { createInterface as qi } from "node:readline";
this.flushPromise = null, this.shutdownPromise = null, this.promiseQueue = new sh(), this._events = new hh(), this._isInitialized = !1, lh(e, "You must pass your PostHog project's ...
throw this.beginBackoff(), new yt(`Your pro
High
Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
dist/index.jsView on unpkg9import { AsyncLocalStorage as tf } from "node:async_hooks";
L10: import { execFile as cn, spawn as At } from "node:child_process";
L11: import { homedir as nf, tmpdir as Vi } from "node:os";
...
L19: import { styleText as _, stripVTControlCharacters as td } from "node:util";
L20: import pe, { stdout as Na, stdin as nd } from "node:process";
L21: import { o as Kr } from "./verify-test-BaZPwJqC.js";
...
L458: platform: ud = ""
L459: } = typeof process > "u" ? {} : process, fd = "NO_COLOR" in Ve || La.includes("--no-color"), dd = "FORCE_COLOR" in Ve || La.includes("--color"), hd = ud === "win32", Pa = Ve.TERM =...
L460: function ja(t, e, n, s, i = e.slice(0, Math.max(0, t)) + s, r = e.slice(Math.max(0, t + n.length)), o = r.indexOf(n)) {
...
L629: }
L630: for (c = 0; c < i.length && i.cha
Findings
3 High4 Medium6 Low
HighCredential Redirect Persistencedist/index.js
HighObfuscated Payload Loaderdist/index.js
HighSemantic Analysis Limitedassets/reference.json
MediumDynamic Requiredist/index.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowEvaldist/index.js
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to @taskless/cli-nightly@0.11.1-20260905063821xcf5232d.
See all versions of @taskless/cli-nightly for other recorded verdicts.
- Review the evidence and your use of @taskless/cli-nightly@0.11.1-20260905063821xcf5232d before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.