@taskless/cli-nightly@0.11.2-20260908005308x64d6808
Nightly build of [`@taskless/cli`](https://www.npmjs.com/package/@taskless/cli) — the same source and the same build, published from an unreleased commit on `main`.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiNo automatic npm lifecycle execution or confirmed payload theft was found. The user-invoked agent-control-surface mutation is a real dangerous capability that warrants a warning.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A user runs taskless init, including taskless init --no-interactive.
Impact
It can alter agent behavior within the selected project.
Mechanism
Writes and removes Taskless AI-agent skill and command files.
AI rationale
No automatic npm lifecycle execution or confirmed payload theft was found. The user-invoked agent-control-surface mutation is a real dangerous capability that warrants a warning.
Evidence
dist/index.js.taskless.claude.opencode.cursor.agents
Decision evidence
public snapshotAI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The init command detects Claude Code, OpenCode, Cursor, and Codex project control surfaces.
- Init writes Taskless skill and command files and can remove previously recorded ones.
- The package exposes this as an explicit user-invoked init command, including a non-interactive mode.
Evidence against
- package.json has no preinstall, install, or postinstall lifecycle hook.
- No self-dependency, hidden payload execution, or credential exfiltration was confirmed.
- Agent-control changes require running the CLI's init command.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShell
HighEntropyStringsTelemetryUrlStrings
Source & flagged code
6 flaggeddist/index.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @taskless/cli-nightly@0.11.1-20260907181107x9edb1f0
matchedIdentity = npm:QHRhc2tsZXNzL2NsaS1uaWdodGx5:0.11.1-20260907181107x9edb1f0
similarity = 0.929
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/index.jsView on unpkg•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/index.js:
import { mkdir as q, readFile as j, writeFile as P, rm as oe, readdir as le, stat as $e, mkdtemp as Ta, copyFile as Vu, glob as Wu, access as Ku, readlink as Gu, rename as Ca, cp a...
import { createReadStream as Yu, existsSync as pi, readFileSync as Ra, globSync as Qu, mkdtempSync as Xu, writeFileSync as Zu, rmSync as ef } from "node:fs";
import tf, { createInterface as Wi } from "node:readline";
this.flushPromise = null, this.shutdownPromise = null, this.promiseQueue = new ih(), this._events = new ph(), this._isInitialized = !1, ch(e, "You must pass your PostHog project's ...
throw this.beginBackoff(), new yt(`Your pro
High
Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
dist/index.jsFindings
1 Critical3 High4 Medium6 Low
CriticalPrevious Version Dangerous Deltadist/index.js
HighCredential Redirect Persistencedist/index.js
HighObfuscated Payload Loaderdist/index.js
HighSemantic Analysis Limitedassets/reference.json
MediumDynamic Requiredist/index.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowEvaldist/index.js
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to @taskless/cli-nightly@0.11.2-20260908005308x64d6808.
See all versions of @taskless/cli-nightly for other recorded verdicts.
- Review the evidence and your use of @taskless/cli-nightly@0.11.2-20260908005308x64d6808 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.