ai4kanban@0.8.1
AI4Kanban's `akb` command — scaffold the Markdown board under docs/kanban/, put an agent on a card, and carry the flows the agent works by.
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe flagged credential references support configured coding-agent runs, while Cloud requests target the package’s own service. The manifest has no install or postinstall hook, and the CLI’s board and agent actions are command-driven.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Board, cloud, or agent-run behavior is reached through an explicit CLI command.
Impact
Expected board operations, agent runs, and optional Cloud requests; no malicious impact found.
Mechanism
The CLI configures credentials for the selected agent provider and uses the package’s own Cloud endpoints for Cloud features; no unrelated credential collector or concealed download execution was identified.
AI rationale
The flagged credential references support configured coding-agent runs, while Cloud requests target the package’s own service. The manifest has no install or postinstall hook, and the CLI’s board and agent actions are command-driven.
Network endpoints5
api.ai4kanban.devyajrbpprmdvtkvjjfpbk.supabase.coapi.openai.comcursor.comopencode.ai
Decision evidence
public snapshotAI called this Clean at 90.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes a CLI and declares prepare and prepublishOnly build scripts, with no install or postinstall hook.
- The CLI dispatches board and agent-run actions from explicit command-line arguments.
- Provider credentials are assembled for the selected agent run; the code removes that harness’s provider-owned variables before adding configured values.
- Cloud requests use the package’s configured AI4Kanban API and Supabase endpoints.
Evidence against
- The flagged provider keys appear in agent-provider configuration, not in a demonstrated credential-exfiltration path.
- The download-and-run strings point to Cursor and OpenCode installation commands for those supported tools.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
4 flaggedbin/ai4kanban.mjsView file
161async function rules() {
L162: return import(pathToFileURL(builtRules()).href)
L163: }
Medium
Dynamic Require
Package source references dynamic require/import behavior.
bin/ai4kanban.mjsView on unpkg · L161dist/kanban.mjsView file
50// `kind` is the machine-readable name of the refusal (card-not-found, no-board,
L51: // unknown-track, …). It is what a caller reads; the exit code stays 1 for every
L52: // refusal, so nobody has to keep a table of numbers.
...
L175: DIR_FLAG = "";
L176: setBoardRoot(process.cwd());
L177: rel = (p) => path.relative(REPO_ROOT, p) || p;
...
L181: // src/lib/agent/worktree.ts
L182: import { spawnSync } from "node:child_process";
L183: import fs2 from "node:fs";
...
L209: windowsHide: true,
L210: ...env ? { env: { ...process.env, ...env } } : {}
L211: });
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/kanban.mjsView on unpkg · L5050// `kind` is the machine-readable name of the refusal (card-not-found, no-board,
L51: // unknown-track, …). It is what a caller reads; the exit code stays 1 for every
L52: // refusal, so nobody has to keep a table of numbers.
...
L175: DIR_FLAG = "";
L176: setBoardRoot(process.cwd());
L177: rel = (p) => path.relative(REPO_ROOT, p) || p;
...
L181: // src/lib/agent/worktree.ts
L182: import { spawnSync } from "node:child_process";
L183: import fs2 from "node:fs";
...
L209: windowsHide: true,
L210: ...env ? { env: { ...process.env, ...env } } : {}
L211: });
Findings
1 Critical1 High4 Medium6 Low
CriticalCredential Exfiltrationdist/kanban.mjs
HighSemantic Analysis Limitedbin/ai4kanban.mjs#virtual:normalized:round1
MediumDynamic Requirebin/ai4kanban.mjs
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowWeak Cryptodist/kanban.mjs
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to ai4kanban@0.8.1.
See all versions of ai4kanban for other recorded verdicts.
- Review the evidence and your use of ai4kanban@0.8.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.