ai4kanban@0.9.2
AI4Kanban's `akb` command — scaffold the Markdown board under docs/kanban/, put an agent on a card, and carry the flows the agent works by.
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe credential indicators point to agent gateway configuration, but the bundle also sends runtime usage telemetry by default without a disclosure gate for CLI use. That undisclosed telemetry warrants a warning; the inspected payloads do not show credential or content exfiltration.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Running the CLI records an app-open event; queued events are sent when the reporting path runs.
Impact
The vendor receives usage activity and limited machine metadata without an explicit opt-in; users can disable reporting with the telemetry command.
Mechanism
The bundle queues usage events with an install ID and posts them to the telemetry endpoint. The inspected events carry usage metadata, not credential or chat contents.
AI rationale
The credential indicators point to agent gateway configuration, but the bundle also sends runtime usage telemetry by default without a disclosure gate for CLI use. That undisclosed telemetry warrants a warning; the inspected payloads do not show credential or content exfiltration.
Evidence
dist/kanban.mjs
Network endpoints2
t.ai4kanban.devt-dev.ai4kanban.dev
Decision evidence
public snapshotAI called this Suspicious at 92.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Usage reporting defaults to enabled when its setting is absent.
- The CLI records an app-open event at command startup, including OS, architecture, and whether this is the first run.
- Queued usage events are sent by POST to the configured telemetry endpoint.
- The reviewed telemetry events contain usage metadata; the credential references are for configuring an agent gateway.
Evidence against
- The bundle provides a command to turn usage reporting off.
- The inspected reporting payload contains event metadata, not API keys or chat contents.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
4 flaggedbin/ai4kanban.mjsView file
85}
L86: return import(pathToFileURL(file).href)
L87: }
Medium
Dynamic Require
Package source references dynamic require/import behavior.
bin/ai4kanban.mjsView on unpkg · L85dist/kanban.mjsView file
59* Constructs the CommanderError class
L60: * @param {number} exitCode suggested exit code which could be used with process.exit
L61: * @param {string} code an id string representing the error
...
L1169: var EventEmitter = __require("node:events").EventEmitter;
L1170: var childProcess = __require("node:child_process");
L1171: var path85 = __require("node:path");
...
L1219: this._outputConfiguration = {
L1220: writeOut: (str4) => process2.stdout.write(str4),
L1221: writeErr: (str4) => process2.stderr.write(str4),
...
L1258: * @returns {Command[]}
L1259: * @private
L1260: */
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/kanban.mjsView on unpkg · L598463closed: false, installId: "", unreadable: true };
const answer2 = values.usageReporting;
const id = values.usageInstallId;
return {
// Absent means on; anything that is not a boolean is an answer this build cannot read,
// and the safe reading of one is off.
on: answer2 === void 0 ? true : answer2 === true,
disclosed: values.usageDisclosureShown === true,
installId: typeof id === "string" ? id : "",
unreadable: false
};
}
function usageReportingOn() {
return readUsageReporting().on;
}
function usageDi
Findings
1 Critical5 Medium6 Low
CriticalCredential Exfiltrationdist/kanban.mjs
MediumDynamic Requirebin/ai4kanban.mjs
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumAi Review Evidencedist/kanban.mjs
LowNon Install Lifecycle Scripts
LowScripts Present
LowWeak Cryptodist/kanban.mjs
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to ai4kanban@0.9.2.
See all versions of ai4kanban for other recorded verdicts.
- Review the evidence and your use of ai4kanban@0.9.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.