@taskless/cli-nightly@0.12.0-20260930050058x56c3a0a
Nightly build of [`@taskless/cli`](https://www.npmjs.com/package/@taskless/cli) — the same source and the same build, published from an unreleased commit on `main`.
AI Security Review
scanned 1mo ago · by lpm-firewall-aiSource confirms explicit CLI-driven agent instruction installation and updates, which the supplied policy classifies as warning-worthy. No block-eligible attack behavior was established.
Static reason
One or more suspicious static signals were detected.
Trigger
Running taskless init, or completing interactive setup from a bare CLI invocation.
Impact
Taskless instructions become available to agent sessions, and subsequent setup can update or remove previously recorded integration files.
Mechanism
The CLI detects project-local agent directories, writes bundled skill and command files, and records installed targets. Later init invocations reconcile those files without an interactive prompt; no background update trigger was established.
AI rationale
Source confirms explicit CLI-driven agent instruction installation and updates, which the supplied policy classifies as warning-worthy. No block-eligible attack behavior was established.
Evidence
dist/index.js.taskless.claude.agents.cursor.opencode
Decision evidence
public snapshotAI called this Suspicious at 94.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- CLI setup targets project-local Claude Code, Codex, Cursor and OpenCode directories.
- The installer writes Taskless skill files and command stubs into selected agent directories.
- The explicit init command automatically detects targets and installs or updates the bundled integration without an interactive prompt.
- Interactive setup asks which tools to enable.
- Installation records target state for subsequent reconciliation.
Evidence against
- package.json has no npm preinstall, install or postinstall hook and no runtime self-dependency.
- The inspected integration installs bundled Taskless content through CLI setup; no covert payload execution or credential export was established.
Behavioral surface
ChildProcessCryptoEvalFilesystemNetwork
HighEntropyStringsTelemetryUrlStrings
Source & flagged code
4 flaggeddist/index.jsView file
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/index.js:
import { readFile as j, mkdir as q, writeFile as U, rm as te, readdir as H, stat as pe, mkdtemp as _l, copyFile as Il, glob as Ad, access as Td, readlink as Cd, rename as Ge, cp as...
import { createReadStream as Pd, globSync as jd, existsSync as Ss, readFileSync as Tl, rmSync as Cl, mkdtempSync as Dd, writeFileSync as Md } from "node:fs";
import Ud, { createInterface as Ms } from "node:readline";
this.flushPromise = null, this.shutdownPromise = null, this.promiseQueue = new Jp(), this._events = new rg(), this._isInitialized = !1, eg(t, "You must pass your PostHog project's ...
throw this.beginBackoff(), new Pt(`Your pro
High
Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
dist/index.jsView on unpkg1#!/usr/bin/env node
L2: import E, { stdin as $d, stdout as $l } from "node:process";
L3: import * as di from "node:tty";
...
L10: import { AsyncLocalStorage as Bd } from "node:async_hooks";
L11: import { execFile as en, spawn as wt } from "node:child_process";
L12: import { RULES_DIRECTORY as G, TASKLESS_DIRECTORY as Vd, ENGINES as Re, ENGINE_LAYOUTS as rt, RULE_TESTS_DIRECTORY as ue, isKnownEngine as bt } from "./layout.js";
...
L458: platform: np = ""
L459: } = typeof process > "u" ? {} : process, sp = "NO_COLOR" in st || jl.includes("--no-color"), ip = "FORCE_COLOR" in st || jl.includes("--color"), rp = np === "win32", Dl = st.TERM =...
L460: function Ml(e, t, n, s, i = t.slice(0, Math.max(0, e)) + s, r = t.slice(Math.max(0, e + n.length)), o = r.indexOf(n)) {
...
L629: }
L630: for
Findings
2 High4 Medium6 Low
HighCredential Redirect Persistencedist/index.js
HighObfuscated Payload Loaderdist/index.js
MediumNetwork
MediumStructural Risk Force Deep Review
MediumAi Review Evidencedist/index.js
MediumAi Review Evidencedist/index.js
LowScripts Present
LowEval
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to @taskless/cli-nightly@0.12.0-20260930050058x56c3a0a.
See all versions of @taskless/cli-nightly for other recorded verdicts.
- Review the evidence and your use of @taskless/cli-nightly@0.12.0-20260930050058x56c3a0a before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.