@taskless/cli-nightly@0.11.1-20260907165206x0553dfb
Nightly build of [`@taskless/cli`](https://www.npmjs.com/package/@taskless/cli) — the same source and the same build, published from an unreleased commit on `main`.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiNo install lifecycle, hidden payload loader, credential redirection, or covert exfiltration was confirmed. The explicit unverified runtime-code path remains a meaningful dangerous capability and warrants a warning.
Static reason
One or more suspicious static signals were detected.
Trigger
Run taskless check in a project containing .taskless runtime rules, especially with --dangerously-run-scripts.
Impact
Runtime-rule code can access files and perform actions available to the invoking user.
Mechanism
Dynamic import and invocation of runtime-rule check.ts.
AI rationale
No install lifecycle, hidden payload loader, credential redirection, or covert exfiltration was confirmed. The explicit unverified runtime-code path remains a meaningful dangerous capability and warrants a warning.
Evidence
dist/index.js.taskless/rules/runtime/<rule>/check.ts.taskless/.run/runtime-rules
Network endpoints2
app.taskless.io/cliz.taskless.io
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The CLI dynamically imports and invokes project runtime-rule check.ts code.
- The check command exposes an explicit flag to run unverified runtime code.
- Authenticated default execution sends runtime-rule signatures to the service and runs only rules it returns as allowed.
Evidence against
- package.json has no preinstall, install, postinstall, or other lifecycle hook.
- Runtime rules are skipped by default when anonymous, unauthenticated, or without a GitHub remote.
- The decoded base64 uses are library YAML/JWT handling, not a hidden payload loader.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShell
HighEntropyStringsTelemetryUrlStrings
Source & flagged code
5 flaggeddist/recipes-CvKZ_SFw.jsView file
173"severity": "error",
L174: "message": "Avoid eval()",
L175: "note": null,
Low
Eval
Package source references a known benign dynamic code generation pattern.
dist/recipes-CvKZ_SFw.jsView on unpkg · L173dist/index.jsView file
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/index.js:
import { mkdir as q, readFile as j, writeFile as P, rm as oe, readdir as le, stat as $e, mkdtemp as Ta, copyFile as Vu, glob as Wu, access as Ku, readlink as Gu, rename as Ca, cp a...
import { createReadStream as Yu, existsSync as hi, readFileSync as Ra, globSync as Qu, mkdtempSync as Xu, writeFileSync as Zu, rmSync as ef } from "node:fs";
import tf, { createInterface as Vi } from "node:readline";
this.flushPromise = null, this.shutdownPromise = null, this.promiseQueue = new ih(), this._events = new ph(), this._isInitialized = !1, ch(e, "You must pass your PostHog project's ...
throw this.beginBackoff(), new yt(`Your pro
High
Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
Findings
3 High4 Medium6 Low
HighCredential Redirect Persistencedist/index.js
HighObfuscated Payload Loaderdist/index.js
HighSemantic Analysis Limitedassets/reference.json
MediumDynamic Requiredist/index.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowEvaldist/recipes-CvKZ_SFw.js
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to @taskless/cli-nightly@0.11.1-20260907165206x0553dfb.
See all versions of @taskless/cli-nightly for other recorded verdicts.
- Review the evidence and your use of @taskless/cli-nightly@0.11.1-20260907165206x0553dfb before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.