registry / claude-task-worker / 0.12.0

claude-task-worker@0.12.0

CLI tool that polls GitHub Issues/PRs and delegates work to Claude CLI

AI Security Review

scanned 2h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

One or more suspicious static signals were detected.

Trigger

User runs a worker command against a repository, or explicitly runs `install`/`usage`.

Impact

A collaborator able to apply trigger labels may cause broad agent actions in the checked-out repository.

Mechanism

GitHub-driven autonomous Claude CLI execution with disabled permission prompts.

Rationale

Source inspection finds no concrete malware or unconsented lifecycle mutation. The deliberate permission-bypassing autonomous agent workflow is a material dangerous capability requiring a warning.

Evidence

package.jsondist/index.jsREADME.mdclaude-task-worker.json.claude/worktrees.github/ISSUE_TEMPLATE/cc-triage-scope.yml.github/workflows/assign-creator-on-cc-triage-scope.yml~/.claude/.credentials.json/tmp/claude-usage-cache.json

Network endpoints1

api.anthropic.com/api/oauth/usage

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

`dist/index.js` launches Claude with `--dangerously-skip-permissions` for labeled GitHub issues.
`dist/index.js` polls GitHub and turns issue numbers into Claude task prompts.
Explicit `install` adds and installs a Claude Code marketplace plugin.
`usage` reads Claude credentials and sends them only to Anthropic's usage API.

Evidence against

`package.json` has only `prepublishOnly`; installation does not execute package code.
No obfuscated payload, dynamic code evaluation, or hidden downloader was found.
Credential-derived token is used as Bearer auth only for Anthropic usage retrieval.
Slack requests use the user-provided webhook environment variable.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 89.0 KB of source, external domains: api.anthropic.com, github.com

Source & flagged code

4 flagged

dist/index.jsView file

Lines 148-188javascript

148 };

149}

150async function checkHerdrAvailable() {

151 const { execError, parsed } = await runHerdr(["tab", "list"]);

152 if (execError?.code === "ENOENT") {

153 throw new HerdrUnavailableError(

154 "herdr\u304C\u30A4\u30F3\u30B9\u30C8\u30FC\u30EB\u3055\u308C\u3066\u3044\u307E\u305B\u3093\u3002herdr CLI\u3092\u30A4\u30F3\u30B9\u30C8\u30FC\u30EB\u3057\u3066\u304F\u3060\u3055\u3044\u3002",

155 "not-installed"

156 );

157 }

158 if (!parsed) {

159 throw new HerdrUnavailableError(

160 "herdr\u30B5\u30FC\u30D0\u30FC\u306B\u63A5\u7D9A\u3067\u304D\u307E\u305B\u3093\u3067\u3057\u305F\u3002`herdr status` \u7B49\u3067\u8D77\u52D5\u72B6\u614B\u3092\u78BA\u8A8D\u3057\u3066\u304F\u3060\u3055\u3044\u3002",

161 "server-unreachable"

162 );

163 }

164}

165var childProcess, HerdrUnavailableError, HerdrError, HERDR_TIMEOUT_MS;

166var init_herdr = __esm({

167 "src/herdr.ts"() {

168 "use strict";

169 childProcess = createRequire(import.meta.url)("node:child_process");

170 HerdrUnavailableError = class extends Error {

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L168

171 reason;

172 constructor(message, reason) {

173 super(message);

174 this.name = "HerdrUnavailableError";

175 this.reason = reason;

176 }

177 };

178 HerdrError = class extends Error {

179 code;

180 constructor(message, code) {

181 super(message);

182 this.name = "HerdrError";

183 this.code = code;

184 }

185 };

186 HERDR_TIMEOUT_MS = 15 * 1e3;

187 }

188});

Lines 1363-1415javascript

1363 "fossil",

1364 "geyser",

1365 "glacier",

1366 "glow",

1367 "granite",

1368 "heath",

1369 "heron",

1370 "hollow"

1371];

1372function pick

Source & flagged code

4 flagged · loading source

dist/index.jsView file

168"use strict"; L169: childProcess = createRequire(import.meta.url)("node:child_process"); L170: HerdrUnavailableError = class extends Error {

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L168

1388import { promisify as promisify2 } from "node:util"; L1389: var execAsync = promisify2(exec); L1390: var WEBHOOK_URL = process.env.CLAUDE_TASK_WORKER_SLACK_WEBHOOK_URL;

High

Shell

Package source references shell execution.

dist/index.jsView on unpkg · L1388

1383// src/slack.ts L1384: import { exec } from "node:child_process"; L1385: import { readFileSync as readFileSync2, writeFileSync } from "node:fs"; ... L1389: var execAsync = promisify2(exec); L1390: var WEBHOOK_URL = process.env.CLAUDE_TASK_WORKER_SLACK_WEBHOOK_URL; L1391: var USAGE_CACHE_PATH = "/tmp/claude-usage-cache.json"; ... L1395: try { L1396: await fetch(WEBHOOK_URL, { L1397: method: "POST",

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L1383

1395try { L1396: await fetch(WEBHOOK_URL, { L1397: method: "POST", L1398: headers: { "Content-Type": "application/json" }, L1399: body: JSON.stringify(payload) L1400: }); ... L1410: try { L1411: const { stdout } = await execAsync('security find-generic-password -s "Claude Code-credentials" -w'); L1412: return extractToken(JSON.parse(stdout.trim()));

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L1395

Findings

4 High2 Medium5 Low

HighChild Processdist/index.js

HighShelldist/index.js

HighSame File Env Network Executiondist/index.js

HighCommand Output Exfiltrationdist/index.js

MediumNetwork

MediumEnvironment Vars

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

dist/index.jsView file

Lines 148-188javascript

148 };

149}

150async function checkHerdrAvailable() {

151 const { execError, parsed } = await runHerdr(["tab", "list"]);

152 if (execError?.code === "ENOENT") {

153 throw new HerdrUnavailableError(

154 "herdr\u304C\u30A4\u30F3\u30B9\u30C8\u30FC\u30EB\u3055\u308C\u3066\u3044\u307E\u305B\u3093\u3002herdr CLI\u3092\u30A4\u30F3\u30B9\u30C8\u30FC\u30EB\u3057\u3066\u304F\u3060\u3055\u3044\u3002",

155 "not-installed"

156 );

157 }

158 if (!parsed) {

159 throw new HerdrUnavailableError(

161 "server-unreachable"

162 );

163 }

164}

165var childProcess, HerdrUnavailableError, HerdrError, HERDR_TIMEOUT_MS;

166var init_herdr = __esm({

167 "src/herdr.ts"() {

168 "use strict";

169 childProcess = createRequire(import.meta.url)("node:child_process");

170 HerdrUnavailableError = class extends Error {

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L168

171 reason;

172 constructor(message, reason) {

173 super(message);

174 this.name = "HerdrUnavailableError";

175 this.reason = reason;

176 }

177 };

178 HerdrError = class extends Error {

179 code;

180 constructor(message, code) {

181 super(message);

182 this.name = "HerdrError";

183 this.code = code;

184 }

185 };

186 HERDR_TIMEOUT_MS = 15 * 1e3;

187 }

188});

Lines 1363-1415javascript

1363 "fossil",

1364 "geyser",

1365 "glacier",

1366 "glow",

1367 "granite",

1368 "heath",

1369 "heron",

1370 "hollow"

1371];

1372function pick