ai4kanban@0.9.0
AI4Kanban's `akb` command — scaffold the Markdown board under docs/kanban/, put an agent on a card, and carry the flows the agent works by.
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe package's lifecycle scripts only build and check the bundle, and the CLI routes user-invoked commands into that bundle. The flagged credential flows configure selected AI agents, while telemetry is limited, disclosed, and can be turned off.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A user runs the CLI command; Cloud actions require Cloud sign-in and agent runs require a run command.
Impact
Expected operation is local Kanban and agent workflow support, optional Cloud use, and anonymous usage counting; no unrelated credential transfer or automatic installer execution was found.
Mechanism
The CLI loads its bundled rules. Selected provider keys are passed to that provider's agent process; usage reports contain the documented limited fields and can be disabled.
AI rationale
The package's lifecycle scripts only build and check the bundle, and the CLI routes user-invoked commands into that bundle. The flagged credential flows configure selected AI agents, while telemetry is limited, disclosed, and can be turned off.
Evidence
docs/kanban/.env
Network endpoints10
api.ai4kanban.devyajrbpprmdvtkvjjfpbk.supabase.cot.ai4kanban.dev/v1/batcht-dev.ai4kanban.dev/v1/batchapi.openai.com/v1api.moonshot.ai/v1cursor.com/installx.ai/cli/install.shcode.kimi.com/install.shopencode.ai/install
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The prepare and prepublishOnly scripts build the bundle and check the version; neither sends data or installs software.
- The CLI loads the package's bundled dist/kanban.mjs when run and dispatches the requested command.
- Provider API keys are configured by the user and saved in docs/kanban/.env for the selected provider.
- Usage reports are limited to fields such as package version, OS, architecture, selected agent harness, and board activity counts.
- The CLI discloses that anonymous usage reporting is on by default and provides an off command that drops queued reports.
- Agent installer commands are returned as plan data; the inspected code does not execute those download-and-shell strings automatically.
Evidence against
- The package contains network requests, environment-variable handling, and download-and-shell installer command strings, but inspected uses are for Cloud, selected AI providers, telemetry, or user-requested agent setup.
- Runtime telemetry is enabled by default, though its fields are limited and the CLI describes how to disable it.
Behavioral surface
Source & flagged code
4 flaggedbin/ai4kanban.mjsView file
85}
L86: return import(pathToFileURL(file).href)
L87: }
Medium
Dynamic Require
Package source references dynamic require/import behavior.
bin/ai4kanban.mjsView on unpkg · L85dist/kanban.mjsView file
59* Constructs the CommanderError class
L60: * @param {number} exitCode suggested exit code which could be used with process.exit
L61: * @param {string} code an id string representing the error
...
L1169: var EventEmitter = __require("node:events").EventEmitter;
L1170: var childProcess = __require("node:child_process");
L1171: var path78 = __require("node:path");
...
L1219: this._outputConfiguration = {
L1220: writeOut: (str4) => process2.stdout.write(str4),
L1221: writeErr: (str4) => process2.stderr.write(str4),
...
L1258: * @returns {Command[]}
L1259: * @private
L1260: */
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/kanban.mjsView on unpkg · L5959* Constructs the CommanderError class
L60: * @param {number} exitCode suggested exit code which could be used with process.exit
L61: * @param {string} code an id string representing the error
...
L1169: var EventEmitter = __require("node:events").EventEmitter;
L1170: var childProcess = __require("node:child_process");
L1171: var path78 = __require("node:path");
...
L1219: this._outputConfiguration = {
L1220: writeOut: (str4) => process2.stdout.write(str4),
L1221: writeErr: (str4) => process2.stderr.write(str4),
...
L1258: * @returns {Command[]}
L1259: * @private
L1260: */
Findings
1 Critical4 Medium7 Low
CriticalCredential Exfiltrationdist/kanban.mjs
MediumDynamic Requirebin/ai4kanban.mjs
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowWeak Cryptodist/kanban.mjs
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowAi Review Evidencepackage.json
Affected versions and remediation
This report applies to ai4kanban@0.9.0.
See all versions of ai4kanban for other recorded verdicts.
- Review the evidence and your use of ai4kanban@0.9.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.