halfcycle@0.4.16
Your coding agents are the engineers. Halfcycle is the rest of the team: it scopes, designs, plans and reviews production software, and runs the build inside your own Claude Code.
AI Security Review
scanned 5d ago · by lpm-firewall-aiThis is not credential exfiltration: the engagement token authenticates to the configured Halfcycle telemetry service, and the record contains run metadata rather than raw tool input. The automatic hook telemetry has no user-facing disclosure or opt-out visible in the inspected package source, so it warrants a warning.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
After a configured project hook evaluates a tool or edit.
Impact
Halfcycle receives per-engagement run and evaluation metadata. The inspected record builder does not include raw tool input or credential values.
Mechanism
The hook builds a run record and POSTs it to CONTROL_TELEMETRY_URL/telemetry with GUARD_SERVICE_TOKEN as bearer authorization; records are also written to a local log.
AI rationale
This is not credential exfiltration: the engagement token authenticates to the configured Halfcycle telemetry service, and the record contains run metadata rather than raw tool input. The automatic hook telemetry has no user-facing disclosure or opt-out visible in the inspected package source, so it warrants a warning.
Evidence
bin/bin.bundle.mjsdist/cli.js~/.halfcycle/guard-eval-log/<phase>.jsonl~/.halfcycle/guard-eval-log/unphased.jsonl
Network endpoints2
control.halfcycle.ai/telemetryCONTROL_TELEMETRY_URL/telemetry
Decision evidence
public snapshotAI called this Suspicious at 78.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Configured Claude hooks automatically emit and post a run record after a guard evaluation.
- The record is sent as JSON to the configured telemetry URL with the engagement token as bearer authorization.
- The record builder includes a random run ID, engagement ID, run type, timestamp, and outcome; it does not serialize the tool input.
- The package source inspected does not show a user-facing disclosure or telemetry opt-out for these hook records.
Evidence against
- The telemetry uses a configured Halfcycle service URL and engagement token, rather than sending credentials to an unrelated collector.
- The record builder describes run metadata and evaluation status, not raw prompts, commands, or credential values.
- The package exposes its CLI through an explicit command and declares no npm lifecycle hook.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShell
Source & flagged code
10 flaggedbin/bin.bundle.mjsView file
19172// dist/git.js
L19173: import { spawnSync } from "node:child_process";
L19174: import { existsSync, readFileSync } from "node:fs";
High
Child Process
Package source references child process execution.
bin/bin.bundle.mjsView on unpkg · L1917214668var WRITE_CAPABLE_TOOLS = ["Edit", "MultiEdit", "NotebookEdit", "Write"];
L14669: var PRE_TOOL_USE_MATCHER = "^(Bash|Read|Grep|Write|Edit|MultiEdit|NotebookEdit|Agent|PowerShell)$";
L14670: function hookCommand(script, verb) {
High
8// dist/guard-origin.js
L9: var DEFAULT_GUARD_ORIGIN = "https://guard.halfcycle.ai";
L10: function resolveGuardOrigin(env) {
...
L26: ZodArray: () => ZodArray,
L27: ZodBase64: () => ZodBase64,
L28: ZodBase64URL: () => ZodBase64URL,
...
L1487: error: new (_Err ?? $ZodError)(result.issues.map((iss) => finalizeIssue(iss, ctx, config())))
L1488: } : { success: true, data: result.value };
L1489: };
...
L14668: var WRITE_CAPABLE_TOOLS = ["Edit", "MultiEdit", "NotebookEdit", "Write"];
L14669: var PRE_TOOL_USE_MATCHER = "^(Bash|Read|Grep|Write|Edit|MultiEdit|NotebookEdit|Agent|PowerShell)$";
L14670: function hookCommand(script, verb) {
Low
Findings
1 Critical7 High4 Medium6 Low
CriticalPrevious Version Dangerous Deltadist/cli.js
HighChild Processbin/bin.bundle.mjs
HighShellbin/bin.bundle.mjs
HighSame File Env Network Executiondist/cli.js
HighCredential Redirect Persistencedist/cli.js
HighSandbox Evasion Gated Capabilitydist/cli.js
HighCross File Remote Execution Contextdist/cli.js
HighRuntime Package Installdist/cli.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperbin/pre-tool-use-filter.sh
MediumStructural Risk Force Deep Review
LowScripts Present
Affected versions and remediation
This report applies to halfcycle@0.4.16.
See all versions of halfcycle for other recorded verdicts.
- Review the evidence and your use of halfcycle@0.4.16 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.