registry / cowork-harness / 0.25.0

cowork-harness@0.25.0

Scriptable, CI-friendly harness for Claude Cowork's runtime contract for testing skills across scenarios — same agent, mounts, egress allowlist, permission protocol, and sandbox limitations.

AI Security Review

scanned 7d ago · by lpm-firewall-ai

No confirmed malicious attack surface was found. Risky primitives are part of an explicit Cowork/Claude test harness CLI and are user-invoked rather than install-time or import-time behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

explicit CLI commands such as run, skill, sync, doctor, decider-cmd, or boundary-check

Impact

Runs local test harness workflows and may create run artifacts or inspect local Claude Desktop state when explicitly requested; no evidence of unconsented mutation or exfiltration.

Mechanism

user-invoked harness orchestration with child processes, sandbox tooling, dotenv loading, and optional Claude Desktop baseline sync

Rationale

Static inspection shows powerful harness capabilities, but they are documented CLI features activated by explicit user commands, with no install-time execution or hidden payload/exfiltration path. The scanner findings map to expected sandbox, decider, sync, and vendored-linter functionality.

Evidence

package.jsondist/cli.jsdist/decide/external-channel.jsdist/sync/cowork-sync.jsdist/run/execute.jsdist/decide/llm-transport.jsdist/secrets.jsdist/dotenv.js.claude/skills/cowork-harness/scripts/_vendor/yaml/scanner.py

Network endpoints5

downloads.claude.ai/claude-code-releases/raw.githubusercontent.com/yaniv-golan/cowork-harness/main/schema/run-result.jsonapi.anthropic.comexample.comexample.com

Decision evidence

public snapshot

AI called this Clean at 86.0% confidence as Benign with low false-positive risk.

Evidence for block

dist/decide/external-channel.js exposes user-supplied --decider-cmd with shell:true, but comments and CLI help show it is an explicit operator command.
dist/sync/cowork-sync.js can run npx @electron/asar and read Claude Desktop files, but only inside explicit macOS sync().
dist/cli.js and dist/dotenv.js load auth env/.env for harness runs; dist/secrets.js scrubs known token values from persisted logs.

Evidence against

package.json has no preinstall/install/postinstall; only prepublishOnly and prepack maintenance scripts.
dist/cli.js is a declared CLI for running sandbox/test harness commands, not import-time execution.
dist/run/execute.js writes run artifacts under the harness runs directory and has path/session guards before deletion or resume.
.claude/skills/cowork-harness/scripts/_vendor/yaml/scanner.py is PyYAML source vendored for linting, not an executable payload.
Network references are package-aligned: Claude downloads/API, GitHub schema URLs, egress proxy checks, and user-invoked sync/doctor/run paths.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 78 file(s), 1.26 MB of source, external domains: api.anthropic.com, cloud-images.ubuntu.com, deb.nodesource.com, downloads.claude.ai, example.com, nodejs.org, raw.githubusercontent.com

Source & flagged code

7 flagged

dist/decide/external-channel.jsView file

Lines 1-24javascript

1import { warn, envPositiveNumber } from "../io.js";

2import { mkdirSync, readdirSync, existsSync, readFileSync, writeFileSync, renameSync, rmSync } from "node:fs";

3import { join } from "node:path";

4import readline from "node:readline";

5import { spawn } from "node:child_process";

6/** A sequential line reader over a stream that buffers across chunk boundaries (readline does this). */

High

Child Process

Package source references child process execution.

dist/decide/external-channel.jsView on unpkg · L4

7function lineReader(input) {

8 const rl = readline.createInterface({ input, crlfDelay: Infinity });

9 const queue = [];

10 const waiters = [];

11 let done = false;

12 rl.on("line", (l) => (waiters.length ? waiters.shift()(l) : queue.push(l)));

13 rl.on("close", () => {

14 done = true;

15 while (waiters.length)

16 waiters.shift()(null);

17 });

18 return {

19 next: () => new Promise((resolve) => {

20 if (queue.length)

21 return resolve(queue.shift());

22 if (done)

23 return resolve(null);

24 waiters.push(resolve);

Lines 194-234javascript

194 // remove the exit listener registered for this channel so repeated fileChannel() calls

195 // in one process don't accumulate listeners past the MaxListenersExceededWarning threshold.

196 process.removeListener("exit", exitHandler);

197 // That exit listener was the only writer of done.json — a long-lived embedder that close()s but

198 // keeps running must still release a `gates --follow` watcher. Write the marker here too (idempotent,

199 // and not matched by the cleanup globs below, so it survives).

200 writeDoneMarker(dir);

201 // Best-effort remove processed files on close (req/resp + .done markers + tmp).

dist/decide/decider.jsView file

Lines 967-1007javascript

967}

968function evalPredicate(expr, input) {

969 // (additive): expose the whole input object as `input` so predicates can reach keys that are not

970 // valid JS identifiers — `input["file-path"]`, `input["foo.bar"]`. We ALSO keep binding each input key as

971 // a bare parameter (`command.includes(...)`), the form used by shipped example scenarios and the docs —

972 // dropping it would silently false-deny those on first run. Only identifier-shaped keys can be bound as a

973 // bare parameter (a key like `file-path` is not a legal parameter name and would fail `new Function`

dist/sync/cowork-sync.jsView file

Lines 145-185javascript

145 return {

146 appVersion,

147 agentVersion,

148 allowDomains,

149 networkMode,

150 requireFullVmSandbox,

151 asarFingerprint: fingerprint,

152 gates,

153 spawnEnv,

154 unknownDeltas: unknown,

155 notes,

156 };

python/conftest.pyView file

•path = python/conftest.py kind = build_helper sizeBytes = 544 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

python/conftest.pyView on unpkg

.claude/skills/cowork-harness/scripts/_vendor/yaml/scanner.pyView file

•path = .claude/skills/cowork-harness/scripts/_vendor/yaml/scanner.py kind = payload_in_excluded_dir sizeBytes = 51279 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.claude/skills/cowork-harness/scripts/_vendor/yaml/scanner.pyView on unpkg

dist/run/execute.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = cowork-harness@0.24.0 matchedIdentity = npm:Y293b3JrLWhhcm5lc3M:0.24.0 similarity = 0.910 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/run/execute.jsView on unpkg

Source & flagged code

7 flagged · loading source

dist/decide/external-channel.jsView file

4import readline from "node:readline"; L5: import { spawn } from "node:child_process"; L6: /** A sequential line reader over a stream that buffers across chunk boundaries (readline does this). */

High

Child Process

Package source references child process execution.

dist/decide/external-channel.jsView on unpkg · L4

214export function spawnChannel(cmd) { L215: // `shell: true` is INTENTIONAL, not an injection surface. `--decider-cmd` is OPERATOR-supplied — L216: // the same trust class as the harness process itself (whoever runs the harness wrote this string). Shell

High

Shell

Package source references shell execution.

dist/decide/external-channel.jsView on unpkg · L214

dist/decide/decider.jsView file

987try { L988: fn = new Function(...params, `"use strict"; return (${expr});`); L989: }

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/decide/decider.jsView on unpkg · L987

dist/sync/cowork-sync.jsView file

165try { L166: execFileSync("npx", ["--yes", "@electron/asar", "extract", ASAR, tmp], { stdio: "ignore" }); L167: const bundle = readIf(join(tmp, ".vite/build/index.js")) ?? "";

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/sync/cowork-sync.jsView on unpkg · L165

python/conftest.pyView file

•path = python/conftest.py kind = build_helper sizeBytes = 544 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

python/conftest.pyView on unpkg

.claude/skills/cowork-harness/scripts/_vendor/yaml/scanner.pyView file

•path = .claude/skills/cowork-harness/scripts/_vendor/yaml/scanner.py kind = payload_in_excluded_dir sizeBytes = 51279 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.claude/skills/cowork-harness/scripts/_vendor/yaml/scanner.pyView on unpkg

dist/run/execute.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/run/execute.jsView on unpkg

Findings

1 Critical4 High4 Medium6 Low

CriticalPrevious Version Dangerous Deltadist/run/execute.js

HighChild Processdist/decide/external-channel.js

HighShelldist/decide/external-channel.js

HighRuntime Package Installdist/sync/cowork-sync.js

HighPayload In Excluded Dir.claude/skills/cowork-harness/scripts/_vendor/yaml/scanner.py

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperpython/conftest.py

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvaldist/decide/decider.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

7 flagged

dist/decide/external-channel.jsView file

Lines 1-24javascript

1import { warn, envPositiveNumber } from "../io.js";

2import { mkdirSync, readdirSync, existsSync, readFileSync, writeFileSync, renameSync, rmSync } from "node:fs";

3import { join } from "node:path";

4import readline from "node:readline";

5import { spawn } from "node:child_process";

6/** A sequential line reader over a stream that buffers across chunk boundaries (readline does this). */

High

Child Process

Package source references child process execution.

dist/decide/external-channel.jsView on unpkg · L4

7function lineReader(input) {

8 const rl = readline.createInterface({ input, crlfDelay: Infinity });

9 const queue = [];

10 const waiters = [];

11 let done = false;

12 rl.on("line", (l) => (waiters.length ? waiters.shift()(l) : queue.push(l)));

13 rl.on("close", () => {

14 done = true;

15 while (waiters.length)

16 waiters.shift()(null);

17 });

18 return {

19 next: () => new Promise((resolve) => {

20 if (queue.length)

21 return resolve(queue.shift());

22 if (done)

23 return resolve(null);

24 waiters.push(resolve);

Lines 194-234javascript

194 // remove the exit listener registered for this channel so repeated fileChannel() calls

195 // in one process don't accumulate listeners past the MaxListenersExceededWarning threshold.

196 process.removeListener("exit", exitHandler);

197 // That exit listener was the only writer of done.json — a long-lived embedder that close()s but

198 // keeps running must still release a `gates --follow` watcher. Write the marker here too (idempotent,

199 // and not matched by the cleanup globs below, so it survives).

200 writeDoneMarker(dir);

201 // Best-effort remove processed files on close (req/resp + .done markers + tmp).

dist/decide/decider.jsView file

Lines 967-1007javascript

967}

968function evalPredicate(expr, input) {

969 // (additive): expose the whole input object as `input` so predicates can reach keys that are not

970 // valid JS identifiers — `input["file-path"]`, `input["foo.bar"]`. We ALSO keep binding each input key as

971 // a bare parameter (`command.includes(...)`), the form used by shipped example scenarios and the docs —

972 // dropping it would silently false-deny those on first run. Only identifier-shaped keys can be bound as a

973 // bare parameter (a key like `file-path` is not a legal parameter name and would fail `new Function`

dist/sync/cowork-sync.jsView file

Lines 145-185javascript

145 return {

146 appVersion,

147 agentVersion,

148 allowDomains,

149 networkMode,

150 requireFullVmSandbox,

151 asarFingerprint: fingerprint,

152 gates,

153 spawnEnv,

154 unknownDeltas: unknown,

155 notes,

156 };

python/conftest.pyView file

•path = python/conftest.py kind = build_helper sizeBytes = 544 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

python/conftest.pyView on unpkg

.claude/skills/cowork-harness/scripts/_vendor/yaml/scanner.pyView file

•path = .claude/skills/cowork-harness/scripts/_vendor/yaml/scanner.py kind = payload_in_excluded_dir sizeBytes = 51279 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.claude/skills/cowork-harness/scripts/_vendor/yaml/scanner.pyView on unpkg

dist/run/execute.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/run/execute.jsView on unpkg