ft-scout@9.0.4
FrontTerrain — The Onboarding Co-Pilot for New Codebases
AI Security Review
scanned 2mo ago · by lpm-firewall-aiSource inspection does not establish credential theft, remote payload execution, or malicious install behavior. The automatic project install and unused archive are real unresolved risks, so this should be warned rather than blocked.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
A user runs scout setup, or independently extracts the bundled archive.
Impact
Project dependency lifecycle scripts can run during setup; the unused archive is an unresolved supply-chain payload carrier.
Mechanism
User-invoked dependency installation and an inert embedded archive.
AI rationale
Source inspection does not establish credential theft, remote payload execution, or malicious install behavior. The automatic project install and unused archive are real unresolved risks, so this should be warned rather than blocked.
Evidence
bin/src/commands/setup.jspackage.json.env
Network endpoints1
registry.npmjs.org
Decision evidence
public snapshotAI called this Suspicious at 82.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The email utility loads the current working directory’s .env file when imported.
- The explicit setup command automatically runs a package-manager install in the current project.
- An unused compressed tar archive is bundled, leaving an opaque payload carrier in the release.
Evidence against
- package.json has no preinstall, install, or postinstall hook and no self-dependency.
- Email delivery is reached only after the user’s signup flow and targets the supplied signup address.
- No source reference to the bundled tar archive was found.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
15 flaggedbin/src/utils/firebaseAuth.jsView file
1patternName = google_api_key
severity = high
line = 1
High
High Secret
Package contains a high-severity secret pattern.
bin/src/utils/firebaseAuth.jsView on unpkg · L11patternName = google_api_key
severity = high
line = 1
High
Secret Pattern
Google API key in bin/src/utils/firebaseAuth.js
bin/src/utils/firebaseAuth.jsView on unpkg · L1bin/src/server/server.jsView file
3import path from 'path';
L4: import { exec } from 'child_process';
L5: import { fileURLToPath } from 'url';
High
Child Process
Package source references child process execution.
bin/src/server/server.jsView on unpkg · L3Findings
3 Critical10 High4 Medium5 Low
CriticalCredential Exfiltrationbin/src/utils/email.js
CriticalTrigger Reachable Dangerous Capabilitybin/src/utils/email.js
CriticalPrevious Version Dangerous Deltabin/src/commands/plan.js
HighHigh Secretbin/src/utils/firebaseAuth.js
HighChild Processbin/src/server/server.js
HighShellbin/src/commands/agent.js
HighSandbox Evasion Gated Capabilitybin/src/commands/setup.js
HighTrigger Reachable Credential Exfiltrationbin/src/utils/email.js
HighRuntime Package Installbin/src/server/server.js
HighShips High Entropy Blobfront-terrain-cli-1.0.0.tgz
HighSemantic Analysis Limitedbin/src/commands/agent.js#virtual:normalized:round1
Affected versions and remediation
This report applies to ft-scout@9.0.4.
See all versions of ft-scout for other recorded verdicts.
- Review the evidence and your use of ft-scout@9.0.4 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.