@tonbo/yield@0.1.1
Tonbo Yield: capture your agents' sessions on every machine and list them from any.
AI Security Review
scanned 6d ago · by lpm-firewall-aiNo concealed credential theft or gated behavior was identified. However, the daemon automatically snapshots eligible worktrees and pushes them to a repository created with `private:false`; this default disclosure risk merits a warning even though the behavior is documented and aligned with the package’s stated purpose.
Static reason
One or more suspicious static signals were detected.
Trigger
A user installs or runs the documented capture daemon; snapshots follow eligible agent turns.
Impact
Project files included in snapshots may be exposed through the non-private remote repository without a separate confirmation for each project.
Mechanism
The daemon stages the worktree with `git add -A`, creates a snapshot repository with `private:false`, and pushes commits to it.
AI rationale
No concealed credential theft or gated behavior was identified. However, the daemon automatically snapshots eligible worktrees and pushes them to a repository created with `private:false`; this default disclosure risk merits a warning even though the behavior is documented and aligned with the package’s stated purpose.
Evidence
README.mddist/bin/yield.js~/.claude/projects~/.codex/sessions${XDG_STATE_HOME:-$HOME/.local/state}/tonbo-yield/snapshots/index/
Network endpoints4
tonbo.devapi.tonbo.devstreams.tonbo.devgit.tonbo.dev
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The documented `yield daemon install` command installs and starts a user service that runs the daemon.
- The daemon snapshots eligible Git worktrees after agent turns; it uses `git add -A` through a private index, with `.gitignore` applying.
- The snapshot repository is created with `private:false`, and commits are pushed to it.
- The package’s stated purpose is capturing agent sessions and snapshots, and its README describes this behavior.
Evidence against
- The user must explicitly install the capture daemon; the package has no npm lifecycle scripts.
- The README discloses session capture and worktree snapshots, including the repository creation behavior.
- The reviewed credential flow exchanges credentials for Tonbo service tokens and uses them with Tonbo endpoints; no gated or concealed behavior was identified.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
Source & flagged code
5 flaggeddist/bin/yield.jsView file
9import { createHash, randomBytes } from "node:crypto";
L10: import { createServer } from "node:http";
L11: import { execFile } from "node:child_process";
L12: import os2 from "node:os";
...
L24: title: "You are signed in.",
L25: body: "Return to your terminal. This tab can be closed."
L26: },
...
L166: const response = await fetcher(url, init);
L167: const body = await response.json().catch(() => null);
L168: if (response.ok)
...
L689: var REFUSED_MODE_BITS = Number.parseInt(credentialsContract.reader.refuse_mode_bits, 8);
L690: function defaultCredentialsPath(env = process.env) {
High
Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
dist/bin/yield.jsView on unpkg · L9README.mdView file
48yield daemon install [--since <date>]
yield daemon status [--json]
yield daemon uninstall
yield daemon run [--since <date>]
```
`install` writes a user service that runs `yield da
Medium
Ai Review Evidence
The documented `yield daemon install` command installs and starts a user service that runs the daemon.
README.mdView on unpkg · L48Findings
1 High7 Medium4 Low
HighSandbox Evasion Gated Capabilitydist/bin/yield.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumAi Review EvidenceREADME.md
MediumAi Review EvidenceREADME.md
MediumAi Review EvidenceREADME.md
MediumAi Review EvidenceREADME.md
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @tonbo/yield@0.1.1.
See all versions of @tonbo/yield for other recorded verdicts.
- Review the evidence and your use of @tonbo/yield@0.1.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.