registry / @taskless/cli-nightly / 0.13.0-20261014230341x6284621
@taskless/cli-nightly@0.13.0-20261014230341x6284621
Nightly build of [`@taskless/cli`](https://www.npmjs.com/package/@taskless/cli) — the same source and the same build, published from an unreleased commit on `main`.
AI Security Review
scanned 21d ago · by lpm-firewall-aiThe executable risk is limited to a user-invoked setup command that places Taskless-owned skill files in detected agent directories. I found no install-hook attack, credential redirect, or executable obfuscated payload in the inspected source.
Static reason
One or more suspicious static signals were detected.
Trigger
A user runs `taskless init` or accepts the interactive setup wizard.
Impact
Supported agents can route Taskless-related requests through the CLI; the observed file changes are limited to the Taskless setup.
Mechanism
The CLI detects supported agent directories, writes Taskless skill files or reference stubs there, and records installation state.
AI rationale
The executable risk is limited to a user-invoked setup command that places Taskless-owned skill files in detected agent directories. I found no install-hook attack, credential redirect, or executable obfuscated payload in the inspected source.
Evidence
package.jsondist/index.js.taskless/skills/<skill>/SKILL.md<detected-agent-dir>/skills/<skill>/SKILL.md
Decision evidence
public snapshotAI called this Suspicious at 89.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The CLI detects agent installations such as Claude Code and OpenCode and selects those directories as possible skill targets.
- The user-invoked `taskless init` command is for installing or updating Taskless skills and calls the installer.
- The installer writes package-owned Taskless skill files into selected agent directories and records the installation state.
- The manifest scripts are build, generation, and test tasks; there is no npm install lifecycle hook.
- The flagged `eval(payload)` and `api.example.com` strings occur in embedded rule demonstration fixtures.
Evidence against
- The agent setup is limited to Taskless skills and reference files in detected agent directories; the source inspected does not show an unrelated agent-control write or credential disclosure.
- The flagged evaluation and API URL samples are fixture content, not executable payload loading or a credential redirect.
Behavioral surface
ChildProcessCryptoEvalFilesystemNetwork
Source & flagged code
4 flaggeddist/index.jsView file
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/index.js:
import { readFile as P, mkdir as K, writeFile as M, rm as ie, readdir as J, stat as ye, mkdtemp as to, copyFile as vc, glob as Sc, access as sp, readlink as ip, rename as Ze, cp as...
import { createReadStream as up, existsSync as Fn, globSync as kc, readFileSync as Ec, rmSync as _c, mkdtempSync as fp, writeFileSync as dp } from "node:fs";
import hp, { createInterface as Un } from "node:readline";
this.flushPromise = null, this.shutdownPromise = null, this.promiseQueue = new Fm(), this._events = new qm(), this._isInitialized = !1, jm(t, "You must pass your PostHog project's ...
throw this.beginBackoff(), new Jt(`Your pro
High
Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
dist/index.jsView on unpkg1#!/usr/bin/env node
L2: import k, { stdin as Zh, stdout as wc } from "node:process";
L3: import * as Li from "node:tty";
...
L10: import { AsyncLocalStorage as pp } from "node:async_hooks";
L11: import { execFile as hn, spawn as it } from "node:child_process";
L12: import { RULES_DIRECTORY as Y, TASKLESS_DIRECTORY as gp, ENGINES as Ne, ENGINE_LAYOUTS as wt, RULE_TESTS_DIRECTORY as pe, isKnownEngine as jt } from "./layout.js";
...
L458: platform: Ng = ""
L459: } = typeof process > "u" ? {} : process, xg = "NO_COLOR" in pt || Nc.includes("--no-color"), Lg = "FORCE_COLOR" in pt || Nc.includes("--color"), Pg = Ng === "win32", xc = pt.TERM =...
L460: function Lc(e, t, n, s, i = t.slice(0, Math.max(0, e)) + s, r = t.slice(Math.max(0, e + n.length)), o = r.indexOf(n)) {
...
L629: }
L630: for
Findings
2 High4 Medium6 Low
HighCredential Redirect Persistencedist/index.js
HighObfuscated Payload Loaderdist/index.js
MediumNetwork
MediumStructural Risk Force Deep Review
MediumAi Review Evidencedist/index.js
MediumAi Review Evidencedist/index.js
LowScripts Present
LowEval
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to @taskless/cli-nightly@0.13.0-20261014230341x6284621.
See all versions of @taskless/cli-nightly for other recorded verdicts.
- Review the evidence and your use of @taskless/cli-nightly@0.13.0-20261014230341x6284621 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.