@vibekiln/cutline-mcp-cli-staging@0.6.0
CLI and MCP servers for Cutline, including SlopBurn: a product quality engineering roguelike RPG for vibecoding workflows.
AI Security Review
scanned 3d ago · by lpm-firewall-aiAn authenticated, user-run `init` command silently sends setup and use events to Cutline's own service, including project-root-derived hashes and the account bearer token; I found no user notice or opt-out in the package. This is undisclosed runtime telemetry, so it warrants a warning rather than a block; no unrelated credential destination was established.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
An authenticated user runs `cutline-mcp init`.
Impact
Cutline can associate the account with a stable project identifier and setup/use events.
Mechanism
The command posts setup events, a Cutline bearer token, and project-root-derived hashed identifiers to Cutline's service.
AI rationale
An authenticated, user-run `init` command silently sends setup and use events to Cutline's own service, including project-root-derived hashes and the account bearer token; I found no user notice or opt-out in the package. This is undisclosed runtime telemetry, so it warrants a warning rather than a block; no unrelated credential destination was established.
Evidence
dist/commands/init.jsdist/utils/agent-funnel.jsdist/utils/config.js~/.cutline-mcp/config.json
Network endpoints2
thecutline.aicutline-staging.web.app
Decision evidence
public snapshotAI called this Suspicious at 84.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Authenticated `init` calls installation registration and then reports completion events.
- Registration and event data are sent by POST with the user's Cutline bearer token.
- Registration includes source and host metadata plus IDs hashed from the project root.
- Completion events include the command, account tier, product graph status, and generated rule count.
- The configured telemetry host is Cutline's own service.
Evidence against
- Telemetry is triggered by the explicit `init` command, not by package installation or import.
- The source shows requests to Cutline's service, with no unrelated credential destination identified.
- The project-root-derived identifiers are hashed.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsTelemetryUrlStrings
Source & flagged code
8 flaggeddist/commands/serve.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @vibekiln/cutline-mcp-cli-staging@0.5.4
matchedIdentity = npm:[redacted]:0.5.4
similarity = 0.931
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/commands/serve.jsView on unpkg1import { execFileSync, spawn } from 'node:child_process';
L2: import { createServer } from 'node:http';
High
Child Process
Package source references child process execution.
dist/commands/serve.jsView on unpkg · L11Cross-file remote execution chain: dist/commands/serve.js spawns dist/servers/cutline-server.js; helper contains network access plus dynamic code execution.
L1: import { execFileSync, spawn } from 'node:child_process';
L2: import { createServer } from 'node:http';
L3: import { resolve, dirname } from 'node:path';
...
L5: import { existsSync } from 'node:fs';
L6: const __dirname = dirname(fileURLToPath(import.meta.url));
L7: export const SERVER_MAP = {
...
L51: try {
L52: const text = Buffer.concat(chunks).toString('utf8');
L53: resolveBody(text ? JSON.parse(text) : {});
...
L67: });
L68: res.end(payload);
L69: }
Findings
1 Critical6 High2 Medium7 Low
CriticalPrevious Version Dangerous Deltadist/commands/serve.js
HighChild Processdist/commands/serve.js
HighShelldist/servers/slopburn-server.js
HighCredential Exfiltrationdist/servers/chunk-OQBG3XDW.js
HighCredential Redirect Persistencedist/commands/init.js
HighCross File Remote Execution Contextdist/commands/serve.js
HighSemantic Analysis Limiteddist/servers/chunk-OQBG3XDW.js#virtual:normalized:round1
MediumNetwork
MediumEnvironment Vars
LowNon Install Lifecycle Scripts
LowScripts Present
LowWeak Cryptodist/servers/slopburn-server.js
Low
Affected versions and remediation
This report applies to @vibekiln/cutline-mcp-cli-staging@0.6.0.
See all versions of @vibekiln/cutline-mcp-cli-staging for other recorded verdicts.
- Review the evidence and your use of @vibekiln/cutline-mcp-cli-staging@0.6.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.