@taskless/cli-nightly@0.11.3-20260923224725x143ff37
Nightly build of [`@taskless/cli`](https://www.npmjs.com/package/@taskless/cli) — the same source and the same build, published from an unreleased commit on `main`.
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe bundle is a CLI that, on an explicit taskless or taskless init invocation, installs its own skills into detected agent directories. There is no install-hook hijack, exfiltration, or remote execution, so the guarded agent-config write is a warning rather than a block.
Static reason
One or more suspicious static signals were detected.
Trigger
User runs taskless with no arguments in a terminal, or runs taskless init.
Impact
Local agent skill and command surfaces for Claude Code, Cursor, OpenCode, and Codex can gain or lose this package's first-party instructions.
Mechanism
The CLI detects host agent directories and writes bundled Taskless skill and command files there, confirming only when a previous install would remove stubs.
AI rationale
The bundle is a CLI that, on an explicit taskless or taskless init invocation, installs its own skills into detected agent directories. There is no install-hook hijack, exfiltration, or remote execution, so the guarded agent-config write is a warning rather than a block.
Evidence
.claude.cursor.opencode.agents.taskless
Decision evidence
public snapshotAI called this Suspicious at 78.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- package.json exposes the taskless bin at dist/index.js and defines no preinstall, install, or postinstall hook.
- The init command installs or updates first-party Taskless skills into detected agent directories such as .claude, .cursor, .opencode, and .agents.
- Reference-mode install writes SKILL.md (and command stubs) under those agent directories when the user runs the CLI.
- The interactive wizard writes those files after a removal prompt; additions proceed when that prompt is not required.
Evidence against
- npm install does not run a lifecycle hook that mutates agent configuration.
- Writes are the package's own skill and command files and run only when the user executes the CLI.
- Authenticated API calls use the Taskless base URL or an operator-set TASKLESS_API_URL, and telemetry honors DO_NOT_TRACK.
Behavioral surface
ChildProcessCryptoEvalFilesystemNetwork
HighEntropyStrings
Source & flagged code
4 flaggeddist/index.jsView file
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/index.js:
import { readFile as P, mkdir as V, writeFile as M, rm as de, readdir as oe, stat as Se, mkdtemp as ml, copyFile as ad, glob as ld, access as cd, readlink as ud, rename as Yt, cp a...
import { createReadStream as pd, globSync as gd, existsSync as ys, readFileSync as bl, mkdtempSync as md, writeFileSync as yd, rmSync as wd } from "node:fs";
import bd, { createInterface as Ls } from "node:readline";
this.flushPromise = null, this.shutdownPromise = null, this.promiseQueue = new Ap(), this._events = new jp(), this._isInitialized = !1, Rp(e, "You must pass your PostHog project's ...
throw this.beginBackoff(), new Rt(`Your pro
High
Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
dist/index.jsView on unpkg1#!/usr/bin/env node
L2: import _, { stdout as pl, stdin as id } from "node:process";
L3: import * as li from "node:tty";
...
L10: import { AsyncLocalStorage as vd } from "node:async_hooks";
L11: import { execFile as Qt, spawn as pt } from "node:child_process";
L12: import { RULES_DIRECTORY as J, TASKLESS_DIRECTORY as Sd, ENGINES as qe, ENGINE_LAYOUTS as Qe, isKnownEngine as gr, RULE_TESTS_DIRECTORY as ge } from "./layout.js";
...
L458: platform: xh = ""
L459: } = typeof process > "u" ? {} : process, Lh = "NO_COLOR" in He || Il.includes("--no-color"), Ph = "FORCE_COLOR" in He || Il.includes("--color"), jh = xh === "win32", Al = He.TERM =...
L460: function Cl(t, e, n, s, i = e.slice(0, Math.max(0, t)) + s, r = e.slice(Math.max(0, t + n.length)), o = r.indexOf(n)) {
...
L629: }
L630: for
Findings
2 High4 Medium6 Low
HighCredential Redirect Persistencedist/index.js
HighObfuscated Payload Loaderdist/index.js
MediumNetwork
MediumStructural Risk Force Deep Review
MediumSuspicious Lifecycle Evidencepackage.json
MediumSuspicious Lifecycle Evidencepackage.json
LowScripts Present
LowEval
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to @taskless/cli-nightly@0.11.3-20260923224725x143ff37.
See all versions of @taskless/cli-nightly for other recorded verdicts.
- Review the evidence and your use of @taskless/cli-nightly@0.11.3-20260923224725x143ff37 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.