@taskless/cli-nightly@0.13.0-20261016004912x80f3934
Nightly build of [`@taskless/cli`](https://www.npmjs.com/package/@taskless/cli) — the same source and the same build, published from an unreleased commit on `main`.
AI Security Review
scanned 20d ago · by lpm-firewall-aiThe manifest declares no install lifecycle hook, and the flagged agent integration is project-local setup through the CLI. The suspicious eval match is part of embedded sample rule text; inspected login code uses Taskless device authorization and local token storage.
Decision evidence
public snapshot- package.json lists no install lifecycle hook and points the module to dist/index.js.
- The flagged agent location detects Claude Code in the project and places its integration in the project-local .claude directory.
- Agent setup runs through the init workflow, which asks before writing agent permission rules.
- Login uses the Taskless app endpoint for device-code authorization and saves the returned token in the project’s .taskless credential file.
- The eval example is embedded in sample rule text, not an executed payload loader.
Source & flagged code
4 flaggedThis package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/index.jsView on unpkgManifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
dist/index.jsFindings
Affected versions and remediation
This report applies to @taskless/cli-nightly@0.13.0-20261016004912x80f3934.
See all versions of @taskless/cli-nightly for other recorded verdicts.
- Review the evidence and your use of @taskless/cli-nightly@0.13.0-20261016004912x80f3934 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.