ai4kanban@0.9.8
AI4Kanban's `akb` command — scaffold the Markdown board under docs/kanban/, put an agent on a card, and carry the flows the agent works by.
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe source implements default-on CLI telemetry that sends usage events to the package's telemetry host without a disclosure check on the command surface. The observed data is limited to pseudonymous usage metadata, so this warrants a warning rather than a malicious verdict.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
CLI startup and subsequent run or chat activity.
Impact
The publisher can associate usage events with a stable pseudonymous installation; the inspected event fields do not include credentials, prompts, or project content.
Mechanism
Queues usage events with a random persistent install ID and sends batches to the package telemetry service.
AI rationale
The source implements default-on CLI telemetry that sends usage events to the package's telemetry host without a disclosure check on the command surface. The observed data is limited to pseudonymous usage metadata, so this warrants a warning rather than a malicious verdict.
Evidence
dist/kanban.mjs$machineHome()/usage-queue.jsonl$machineHome()/usage-state.json
Network endpoints2
t.ai4kanban.dev/v1/batcht-dev.ai4kanban.dev/v1/batch
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- CLI usage reporting defaults to enabled when no setting exists; the command path does not require the app disclosure check before reporting.
- Starting a CLI command reports an app-open event; run and chat activity also report event counts, and batches are POSTed to the telemetry endpoint.
- The events include a persistent random install ID and event metadata, but the inspected fields do not include credentials or chat content.
Evidence against
- Reported fields are limited to event names, date, version, surface, OS, architecture, first-run status, and agent harness; chat reporting sends a count event rather than the message.
- Cloud session tokens are sent to the package's own Cloud API for its authenticated Cloud operations.
- Provider API key variables are referenced in agent-provider configuration, consistent with passing them to the selected agent.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork
Source & flagged code
6 flaggeddist/kanban.mjsView file
59* Constructs the CommanderError class
L60: * @param {number} exitCode suggested exit code which could be used with process.exit
L61: * @param {string} code an id string representing the error
...
L1169: var EventEmitter = __require("node:events").EventEmitter;
L1170: var childProcess = __require("node:child_process");
L1171: var path101 = __require("node:path");
...
L1219: this._outputConfiguration = {
L1220: writeOut: (str4) => process2.stdout.write(str4),
L1221: writeErr: (str4) => process2.stderr.write(str4),
...
L1258: * @returns {Command[]}
L1259: * @private
L1260: */
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/kanban.mjsView on unpkg · L591169var EventEmitter = __require("node:events").EventEmitter;
L1170: var childProcess = __require("node:child_process");
L1171: var path101 = __require("node:path");
High
2009}
L2010: const execArgv = process2.execArgv ?? [];
L2011: if (execArgv.includes("-e") || execArgv.includes("--eval") || execArgv.includes("-p") || execArgv.includes("--print")) {
High
Findings
1 Critical3 High4 Medium6 Low
CriticalCredential Exfiltrationdist/kanban.mjs
HighChild Processdist/kanban.mjs
HighShelldist/kanban.mjs
HighCommand Output Exfiltrationdist/kanban.mjs
MediumDynamic Requirebin/ai4kanban.mjs
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowWeak Cryptodist/kanban.mjs
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to ai4kanban@0.9.8.
See all versions of ai4kanban for other recorded verdicts.
- Review the evidence and your use of ai4kanban@0.9.8 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.