ai4kanban@0.9.6
AI4Kanban's `akb` command — scaffold the Markdown board under docs/kanban/, put an agent on a card, and carry the flows the agent works by.
AI Security Review
scanned 3d ago · by lpm-firewall-aiNo automatic credential theft or other clear attack behavior was identified. The Codex runner nevertheless disables approval and sandbox protections by default, a risky capability that merits a warning.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A user runs a Codex agent through the CLI without specifying a sandbox mode.
Impact
The agent can perform actions outside the project workspace or run commands without per-action approval.
Mechanism
The runner adds --dangerously-bypass-approvals-and-sandbox, allowing Codex to operate without its normal approval and sandbox protections.
AI rationale
No automatic credential theft or other clear attack behavior was identified. The Codex runner nevertheless disables approval and sandbox protections by default, a risky capability that merits a warning.
Evidence
dist/kanban.mjs
Network endpoints1
t.ai4kanban.dev/v1/batch
Decision evidence
public snapshotAI called this Suspicious at 89.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- The Codex harness adds --dangerously-bypass-approvals-and-sandbox unless the user supplies a sandbox-related flag.
- The shipped Codex agent configuration also includes that bypass flag by default.
- Usage telemetry sends app and runtime fields such as OS and architecture; the CLI describes it as anonymous and provides a way to turn it off.
Evidence against
- No automatic credential exfiltration was identified in the reviewed request paths.
- The bypass is used when a user runs a Codex agent through the CLI; no install-time execution hook is declared.
- The telemetry description discloses that reporting is on by default and points users to the telemetry command to change it.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
4 flaggedbin/ai4kanban.mjsView file
85}
L86: return import(pathToFileURL(file).href)
L87: }
Medium
Dynamic Require
Package source references dynamic require/import behavior.
bin/ai4kanban.mjsView on unpkg · L85dist/kanban.mjsView file
59* Constructs the CommanderError class
L60: * @param {number} exitCode suggested exit code which could be used with process.exit
L61: * @param {string} code an id string representing the error
...
L1169: var EventEmitter = __require("node:events").EventEmitter;
L1170: var childProcess = __require("node:child_process");
L1171: var path98 = __require("node:path");
...
L1219: this._outputConfiguration = {
L1220: writeOut: (str4) => process2.stdout.write(str4),
L1221: writeErr: (str4) => process2.stderr.write(str4),
...
L1258: * @returns {Command[]}
L1259: * @private
L1260: */
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/kanban.mjsView on unpkg · L598613const sandboxFlags = ["--sandbox", "-s", "--full-auto", "--dangerously-bypass-approvals-and-sandbox"];
if (!namesFlag(argv, sandboxFlags)) {
extra.push("--dangerously-bypass-approvals-and-sandbox");
}
for (const config
Findings
1 Critical5 Medium6 Low
CriticalCredential Exfiltrationdist/kanban.mjs
MediumDynamic Requirebin/ai4kanban.mjs
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumAi Review Evidencedist/kanban.mjs
LowNon Install Lifecycle Scripts
LowScripts Present
LowWeak Cryptodist/kanban.mjs
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to ai4kanban@0.9.6.
See all versions of ai4kanban for other recorded verdicts.
- Review the evidence and your use of ai4kanban@0.9.6 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.