registry / @taskless/cli-nightly / 0.12.1-20261009003536xa5e60a0
@taskless/cli-nightly@0.12.1-20261009003536xa5e60a0
Nightly build of [`@taskless/cli`](https://www.npmjs.com/package/@taskless/cli) — the same source and the same build, published from an unreleased commit on `main`.
AI Security Review
scanned 27d ago · by lpm-firewall-aiSource inspection found no registry install hook, active credential forwarding to an unofficial gateway, or executable hidden payload in the inspected flagged regions. The agent setup behavior is project-local and reached through an interactive CLI path, so the scanner hints do not establish malicious behavior.
Static reason
One or more suspicious static signals were detected.
Trigger
Running the CLI setup command interactively in a project.
Impact
This can add package-owned skill files to a project after the user invokes setup; the inspected code does not establish credential theft or covert agent control.
Mechanism
The CLI detects existing agent directories and can write generated skills into project-local reference folders.
AI rationale
Source inspection found no registry install hook, active credential forwarding to an unofficial gateway, or executable hidden payload in the inspected flagged regions. The agent setup behavior is project-local and reached through an interactive CLI path, so the scanner hints do not establish malicious behavior.
Evidence
dist/index.js
Decision evidence
public snapshotAI called this Clean at 89.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json defines no preinstall, install, or postinstall hook; it exposes the CLI through dist/index.js.
- dist/index.js detects agent project directories, including Claude Code, as targets for its setup behavior.
- The agent skill writer creates project-local reference files, and the inspected CLI setup path reaches an interactive prompt.
- The flagged unofficial gateway URL appears in embedded sample text, not as an active credential-forwarding operation.
- The inspected base64 conversion is ordinary encoding logic; it does not establish hidden payload execution.
Evidence against
Behavioral surface
ChildProcessCryptoEvalFilesystemNetwork
HighEntropyStringsTelemetryUrlStrings
Source & flagged code
4 flaggeddist/index.jsView file
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/index.js:
import { readFile as D, mkdir as W, writeFile as V, rm as ie, readdir as Q, stat as ge, mkdtemp as Zl, copyFile as ec, glob as tc, access as Ch, readlink as Rh, rename as Qe, cp as...
import { createReadStream as jh, existsSync as An, globSync as sc, readFileSync as ic, rmSync as rc, mkdtempSync as Dh, writeFileSync as Mh } from "node:fs";
import Uh, { createInterface as Qs } from "node:readline";
this.flushPromise = null, this.shutdownPromise = null, this.promiseQueue = new am(), this._events = new ym(), this._isInitialized = !1, dm(t, "You must pass your PostHog project's ...
throw this.beginBackoff(), new Vt(`Your pro
High
Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
dist/index.jsView on unpkg1#!/usr/bin/env node
L2: import k, { stdin as _h, stdout as Ql } from "node:process";
L3: import * as _i from "node:tty";
...
L10: import { AsyncLocalStorage as Bh } from "node:async_hooks";
L11: import { execFile as cn, spawn as Et } from "node:child_process";
L12: import { RULES_DIRECTORY as J, TASKLESS_DIRECTORY as qh, ENGINES as Fe, ENGINE_LAYOUTS as dt, RULE_TESTS_DIRECTORY as he, isKnownEngine as Ct } from "./layout.js";
...
L458: platform: ag = ""
L459: } = typeof process > "u" ? {} : process, lg = "NO_COLOR" in ut || hc.includes("--no-color"), cg = "FORCE_COLOR" in ut || hc.includes("--color"), ug = ag === "win32", pc = ut.TERM =...
L460: function gc(e, t, n, s, i = t.slice(0, Math.max(0, e)) + s, r = t.slice(Math.max(0, e + n.length)), o = r.indexOf(n)) {
...
L629: }
L630: for
Findings
2 High2 Medium8 Low
HighCredential Redirect Persistencedist/index.js
HighObfuscated Payload Loaderdist/index.js
MediumNetwork
MediumStructural Risk Force Deep Review
LowScripts Present
LowEval
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/index.js
Affected versions and remediation
This report applies to @taskless/cli-nightly@0.12.1-20261009003536xa5e60a0.
See all versions of @taskless/cli-nightly for other recorded verdicts.
- Review the evidence and your use of @taskless/cli-nightly@0.12.1-20261009003536xa5e60a0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.