@taskless/cli-nightly@0.13.0-20261016063021x39568f3
Nightly build of [`@taskless/cli`](https://www.npmjs.com/package/@taskless/cli) — the same source and the same build, published from an unreleased commit on `main`.
AI Security Review
scanned 20d ago · by lpm-firewall-aiThe source supports conditional credential exposure when an operator redirects the API URL, so this warrants a warning. The manifest has no install hook, the default endpoint is first-party, and agent skill setup runs through the explicit init command.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
An authenticated CLI command makes an API request while TASKLESS_API_URL or config.json apiUrl points to an unrelated host.
Impact
The configured recipient can receive the Taskless credential; source does not establish default disclosure to a package-selected third party.
Mechanism
The client uses the configured URL without a host allowlist and adds the saved token as a Bearer header.
AI rationale
The source supports conditional credential exposure when an operator redirects the API URL, so this warrants a warning. The manifest has no install hook, the default endpoint is first-party, and agent skill setup runs through the explicit init command.
Evidence
dist/index.js
Network endpoints1
app.taskless.io/cli
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- package.json lists build and development scripts but no preinstall, install, or postinstall hook.
- The API URL comes from TASKLESS_API_URL or config.json and otherwise defaults to https://app.taskless.io/cli; the source shows no host allowlist.
- The CLI can obtain an existing token from TASKLESS_TOKEN or saved project authentication.
- The API client attaches that token as a Bearer header, and the whoami request uses this client.
- Agent skill destinations are local tool directories; the installer path is invoked by the explicit init command.
Evidence against
Behavioral surface
ChildProcessCryptoEvalFilesystemNetwork
HighEntropyStringsTelemetryUrlStrings
Source & flagged code
4 flaggeddist/index.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @taskless/cli-nightly@0.13.0-20261016013447x784899c
matchedIdentity = npm:QHRhc2tsZXNzL2NsaS1uaWdodGx5:0.13.0-20261016013447x784899c
similarity = 0.929
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/index.jsView on unpkg•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/index.js:
import { readFile as x, mkdir as z, writeFile as B, rm as oe, readdir as Q, stat as $e, mkdtemp as No, copyFile as ou, glob as au, access as Qp, readlink as Zp, rename as rt, cp as...
import { createReadStream as rg, globSync as Lo, readdirSync as og, existsSync as qn, readFileSync as lu, rmSync as cu, mkdtempSync as ag, writeFileSync as lg } from "node:fs";
import cg, { createInterface as Zn } from "node:readline";
this.flushPromise = null, this.shutdownPromise = null, this.promiseQueue = new Oy(), this._events = new My(), this._isInitialized = !1, Cy(t, "You must pass your PostHog project's ...
throw this.beginBackoff(
High
Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
dist/index.jsFindings
1 Critical2 High3 Medium6 Low
CriticalPrevious Version Dangerous Deltadist/index.js
HighCredential Redirect Persistencedist/index.js
HighObfuscated Payload Loaderdist/index.js
MediumNetwork
MediumStructural Risk Force Deep Review
MediumSuspicious Lifecycle Evidencepackage.json
LowScripts Present
LowEval
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to @taskless/cli-nightly@0.13.0-20261016063021x39568f3.
See all versions of @taskless/cli-nightly for other recorded verdicts.
- Review the evidence and your use of @taskless/cli-nightly@0.13.0-20261016063021x39568f3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.