The manifest has no install hook, and the flagged behaviors are tied to explicit project CLI workflows. Source inspection found no concrete malicious collection, execution, or account action; the scanner’s risk labels alone do not establish an attack.
The CLI runs only when a user invokes a command; login requires browser approval.
Impact
No unrequested account changes, hidden credential transfer, or automatic code execution were identified.
Mechanism
Project commands read local project files, pull writes filtered source for a selected app, and login sends a machine label to the configured dashboard.
AI rationale
The manifest has no install hook, and the flagged behaviors are tied to explicit project CLI workflows. Source inspection found no concrete malicious collection, execution, or account action; the scanner’s risk labels alone do not establish an attack.
Network endpoints1
onpattern.app
Decision evidence
public snapshot
AI called this Clean at 90.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
The cited modules implement SDK stores, React UI, and server features; their inspected runtime hints show subscriptions, rendering, and page-title updates.
The manifest exposes an `app` CLI and contains no install lifecycle hook.
The CLI imports project schema and seed files for project commands; its command dispatcher handles supplied commands and arguments.
Agent-instruction migration is a named CLI command that operates on the project AGENTS.md file.
The pull command downloads the selected app’s source and filters paths before writing project files.
Login uses the onpattern.app dashboard; the computer label is sent during browser-approved login or setup, and saved cookies are sent to that dashboard.
276`Run ./app check until it passes, then ./app publish --message "<what changed>" straight away: this first change goes live without asking, so they see their real site change at ${u...
L277: `Then tell them their site lives in ${folder}, that next time they can start Claude there, and that from now on you"ll show changes on this computer first and publish when they say...
L278: }
High
Command Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
276Trigger-reachable command-output exfiltration chain: manifest.bin -> dist/cli/app.js -> dist/cli/publishing.js
L276: `Run ./app check until it passes, then ./app publish --message "<what changed>" straight away: this first change goes live without asking, so they see their real site change at ${u...
L277: `Then tell them their site lives in ${folder}, that next time they can start Claude there, and that from now on you"ll show changes on this computer first and publish when they say...
L278: }
High
Trigger Reachable Command Output Exfiltration
A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.
276`Run ./app check until it passes, then ./app publish --message "<what changed>" straight away: this first change goes live without asking, so they see their real site change at ${u...
L277: `Then tell them their site lives in ${folder}, that next time they can start Claude there, and that from now on you"ll show changes on this computer first and publish when they say...
L278: }
High
Command Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
276Trigger-reachable command-output exfiltration chain: manifest.bin -> dist/cli/app.js -> dist/cli/publishing.js
L276: `Run ./app check until it passes, then ./app publish --message "<what changed>" straight away: this first change goes live without asking, so they see their real site change at ${u...
L277: `Then tell them their site lives in ${folder}, that next time they can start Claude there, and that from now on you"ll show changes on this computer first and publish when they say...
L278: }
High
Trigger Reachable Command Output Exfiltration
A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.