@taskless/cli@0.13.0
[](https://www.npmjs.com/package/@taskless/cli) [](https://github.com/taskless/cli/actions/workflows/val
AI Security Review
scanned 19d ago · by lpm-firewall-aiThe manifest has no install lifecycle hook, and the flagged agent integration is part of an explicit CLI setup path. The inspected decoding and eval matches are benign parsing and rule-description code, respectively.
Decision evidence
public snapshot- package.json lists no install lifecycle hook and points the package entrypoint to dist/index.js.
- The inspected bundle location identifies project agent directories such as .claude and .opencode.
- The skill writer places Taskless skill files under a selected project target or the .taskless store.
- The init command calls the skill setup routine when explicitly run.
- The atob match decodes Base64 data into bytes; it does not execute reconstructed code.
- The eval match appears in text describing a rule that detects eval calls.
Source & flagged code
4 flaggedThis package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/index.jsView on unpkgManifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
dist/index.jsView on unpkgFindings
Affected versions and remediation
This report applies to @taskless/cli@0.13.0.
See all versions of @taskless/cli for other recorded verdicts.
- Review the evidence and your use of @taskless/cli@0.13.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.