@taskless/cli-nightly@0.13.0-20261014152447x60763fb
Nightly build of [`@taskless/cli`](https://www.npmjs.com/package/@taskless/cli) — the same source and the same build, published from an unreleased commit on `main`.
AI Security Review
scanned 21d ago · by lpm-firewall-aiSource inspection confirmed user-invoked agent setup that writes package-owned references into project agent directories, so a warning is appropriate. The credential and dynamic-import scanner signals are explained by the Taskless device-code flow and a rule-check harness.
Static reason
One or more suspicious static signals were detected.
Trigger
A user invokes `taskless init`.
Impact
Adds Taskless guidance and commands to project agent integrations; no credential theft or unconsented install-time control-surface change was established.
Mechanism
The CLI detects supported agent directories and writes package-generated references to their skill and command locations.
AI rationale
Source inspection confirmed user-invoked agent setup that writes package-owned references into project agent directories, so a warning is appropriate. The credential and dynamic-import scanner signals are explained by the Taskless device-code flow and a rule-check harness.
Evidence
package.jsondist/index.js.taskless.claude.agents.cursor.opencode
Decision evidence
public snapshotAI called this Suspicious at 92.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The manifest exposes the CLI entrypoint and lists build scripts, including prebuild, but no npm install hook.
- The explicit `init` command is described as installing or updating Taskless skills, and its runner invokes the installer.
- The installer detects project agent directories and maps them to reference targets such as `.claude`, `.agents`, `.cursor`, and `.opencode`.
- On that command path, package-generated skill and command references are written to the selected targets and the install state is recorded under `.taskless`.
- Login polls the configured Taskless API base with a device code; its default is the Taskless CLI service, not a fixed unrelated gateway.
- The flagged dynamic import is in a rule-check harness that imports a supplied `checkFile` and calls its exported check function.
Evidence against
Behavioral surface
ChildProcessCryptoEvalFilesystemNetwork
HighEntropyStrings
Source & flagged code
4 flaggeddist/index.jsView file
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/index.js:
import { readFile as P, mkdir as W, writeFile as U, rm as ie, readdir as J, stat as ye, mkdtemp as to, copyFile as vc, glob as Sc, access as np, readlink as sp, rename as Ze, cp as...
import { createReadStream as cp, existsSync as xn, globSync as kc, readFileSync as Ec, rmSync as _c, mkdtempSync as up, writeFileSync as fp } from "node:fs";
import dp, { createInterface as qn } from "node:readline";
this.flushPromise = null, this.shutdownPromise = null, this.promiseQueue = new Om(), this._events = new Bm(), this._isInitialized = !1, Pm(t, "You must pass your PostHog project's ...
throw this.beginBackoff(), new Xt(`Your pro
High
Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
dist/index.jsView on unpkg1#!/usr/bin/env node
L2: import $, { stdin as Qh, stdout as wc } from "node:process";
L3: import * as Li from "node:tty";
...
L10: import { AsyncLocalStorage as hp } from "node:async_hooks";
L11: import { execFile as gn, spawn as it } from "node:child_process";
L12: import { RULES_DIRECTORY as Y, TASKLESS_DIRECTORY as pp, ENGINES as Ne, ENGINE_LAYOUTS as yt, RULE_TESTS_DIRECTORY as pe, isKnownEngine as jt } from "./layout.js";
...
L458: platform: Fg = ""
L459: } = typeof process > "u" ? {} : process, Ng = "NO_COLOR" in ht || Nc.includes("--no-color"), xg = "FORCE_COLOR" in ht || Nc.includes("--color"), Lg = Fg === "win32", xc = ht.TERM =...
L460: function Lc(e, t, n, s, i = t.slice(0, Math.max(0, e)) + s, r = t.slice(Math.max(0, e + n.length)), o = r.indexOf(n)) {
...
L629: }
L630: for
Findings
2 High4 Medium6 Low
HighCredential Redirect Persistencedist/index.js
HighObfuscated Payload Loaderdist/index.js
MediumNetwork
MediumStructural Risk Force Deep Review
MediumSuspicious Lifecycle Evidencepackage.json
MediumSuspicious Lifecycle Evidencepackage.json
LowScripts Present
LowEval
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to @taskless/cli-nightly@0.13.0-20261014152447x60763fb.
See all versions of @taskless/cli-nightly for other recorded verdicts.
- Review the evidence and your use of @taskless/cli-nightly@0.13.0-20261014152447x60763fb before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.