registry / @taskless/cli-nightly / 0.13.0-20261013000223x62ed6e5
@taskless/cli-nightly@0.13.0-20261013000223x62ed6e5
Nightly build of [`@taskless/cli`](https://www.npmjs.com/package/@taskless/cli) — the same source and the same build, published from an unreleased commit on `main`.
AI Security Review
scanned 23d ago · by lpm-firewall-aiThe flagged source supports a first-party agent setup capability, but not the reported credential redirect or hidden payload execution. Because the explicit init path installs agent guidance, classify this as a warning under the agent extension policy.
Static reason
One or more suspicious static signals were detected.
Trigger
A user runs the taskless init command or proceeds through the interactive setup wizard.
Impact
Agent tools may follow the installed Taskless guidance; the inspected source does not establish an unconsented hijack.
Mechanism
The installer writes bundled Taskless files into selected agent directories and checks existing files before replacing them.
AI rationale
The flagged source supports a first-party agent setup capability, but not the reported credential redirect or hidden payload execution. Because the explicit init path installs agent guidance, classify this as a warning under the agent extension policy.
Evidence
dist/index.js.taskless/.claude/.agents/.cursor/.opencode/
Decision evidence
public snapshotAI called this Suspicious at 79.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- package.json exposes dist/index.js as a CLI executable; its scripts are build, generation, reference, test, and typecheck tasks.
- The bundle provides an init command to install or update Taskless skills, and its batch path runs that installer.
- The installer detects agent directories and writes bundled Taskless skills and command stubs there; it checks existing files and avoids replacing symlinks or files that fail its ownership checks.
- The interactive setup asks which tools to enable and shows planned changes before proceeding; the explicit init command is the non-interactive setup path.
- Authentication uses device-code login with app.taskless.io/cli as the default API base; token polling sends a device code.
Evidence against
- The manifest has no npm preinstall, install, or postinstall hook.
- The inspected source supports a first-party agent setup capability, but does not establish an agent control hijack or credential theft.
Behavioral surface
ChildProcessCryptoEvalFilesystem
Source & flagged code
4 flaggeddist/index.jsView file
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/index.js:
import { readFile as j, mkdir as W, writeFile as V, rm as re, readdir as Q, stat as me, mkdtemp as zr, copyFile as oc, glob as ac, access as Fh, readlink as Nh, rename as Qe, cp as...
import { createReadStream as Mh, existsSync as Nn, globSync as cc, readFileSync as uc, rmSync as fc, mkdtempSync as Uh, writeFileSync as Bh } from "node:fs";
import qh, { createInterface as Bn } from "node:readline";
this.flushPromise = null, this.shutdownPromise = null, this.promiseQueue = new lm(), this._events = new wm(), this._isInitialized = !1, hm(t, "You must pass your PostHog project's ...
throw this.beginBackoff(), new Jt(`Your pro
High
Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
dist/index.jsView on unpkg1#!/usr/bin/env node
L2: import k, { stdin as Th, stdout as ic } from "node:process";
L3: import * as Ti from "node:tty";
...
L10: import { AsyncLocalStorage as Vh } from "node:async_hooks";
L11: import { execFile as pn, spawn as nt } from "node:child_process";
L12: import { RULES_DIRECTORY as J, TASKLESS_DIRECTORY as Kh, ENGINES as Fe, ENGINE_LAYOUTS as pt, RULE_TESTS_DIRECTORY as pe, isKnownEngine as Lt } from "./layout.js";
...
L458: platform: lg = ""
L459: } = typeof process > "u" ? {} : process, cg = "NO_COLOR" in ft || wc.includes("--no-color"), ug = "FORCE_COLOR" in ft || wc.includes("--color"), fg = lg === "win32", bc = ft.TERM =...
L460: function vc(e, t, n, s, i = t.slice(0, Math.max(0, e)) + s, r = t.slice(Math.max(0, e + n.length)), o = r.indexOf(n)) {
...
L629: }
L630: for
Findings
2 High4 Medium6 Low
HighCredential Redirect Persistencedist/index.js
HighObfuscated Payload Loaderdist/index.js
MediumNetwork
MediumStructural Risk Force Deep Review
MediumAi Review Evidencepackage.json
MediumAi Review Evidencepackage.json
LowScripts Present
LowEval
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to @taskless/cli-nightly@0.13.0-20261013000223x62ed6e5.
See all versions of @taskless/cli-nightly for other recorded verdicts.
- Review the evidence and your use of @taskless/cli-nightly@0.13.0-20261013000223x62ed6e5 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.