halfcycle@0.4.17
Your coding agents are the engineers. Halfcycle is the rest of the team: it scopes, designs, plans and reviews production software, and runs the build inside your own Claude Code.
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe package’s credential flow targets its own service by default, and the alternate service URL is supplied through the user’s environment. The scanner’s credential and process findings are consistent with the package’s stated CLI and integration behavior.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
User runs the halfcycle CLI command or a library operation that requires the service.
Impact
No malicious impact identified in the reviewed flows.
Mechanism
The CLI defaults to control.halfcycle.ai and sends its Halfcycle credential to the selected service URL; an override comes from the user’s environment.
AI rationale
The package’s credential flow targets its own service by default, and the alternate service URL is supplied through the user’s environment. The scanner’s credential and process findings are consistent with the package’s stated CLI and integration behavior.
Network endpoints1
control.halfcycle.ai
Decision evidence
public snapshotAI called this Clean at 92.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package exports dist/index.js as its library entry and exposes dist/bin.js as a separate CLI.
- The CLI defaults its service origin to control.halfcycle.ai.
- The CLI sends its Halfcycle credential as a bearer token to the service URL it uses.
- The service URL override is read from the environment when the CLI command runs.
Evidence against
- The CLI uses network requests and subprocesses for its Halfcycle and Claude Code functions, which match the package’s stated purpose.
- The reviewed manifest has build and typecheck scripts but no install lifecycle hook.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
10 flaggedbin/bin.bundle.mjsView file
19185// dist/git.js
L19186: import { spawnSync } from "node:child_process";
L19187: import { existsSync, readFileSync } from "node:fs";
High
Child Process
Package source references child process execution.
bin/bin.bundle.mjsView on unpkg · L1918514668var WRITE_CAPABLE_TOOLS = ["Edit", "MultiEdit", "NotebookEdit", "Write"];
L14669: var PRE_TOOL_USE_MATCHER = "^(Bash|Read|Grep|Write|Edit|MultiEdit|NotebookEdit|Agent|PowerShell)$";
L14670: function hookCommand(script, verb) {
High
8// dist/guard-origin.js
L9: var DEFAULT_GUARD_ORIGIN = "https://guard.halfcycle.ai";
L10: function resolveGuardOrigin(env) {
...
L26: ZodArray: () => ZodArray,
L27: ZodBase64: () => ZodBase64,
L28: ZodBase64URL: () => ZodBase64URL,
...
L1487: error: new (_Err ?? $ZodError)(result.issues.map((iss) => finalizeIssue(iss, ctx, config())))
L1488: } : { success: true, data: result.value };
L1489: };
...
L14668: var WRITE_CAPABLE_TOOLS = ["Edit", "MultiEdit", "NotebookEdit", "Write"];
L14669: var PRE_TOOL_USE_MATCHER = "^(Bash|Read|Grep|Write|Edit|MultiEdit|NotebookEdit|Agent|PowerShell)$";
L14670: function hookCommand(script, verb) {
Low
Findings
1 Critical7 High4 Medium6 Low
CriticalPrevious Version Dangerous Deltadist/cli.js
HighChild Processbin/bin.bundle.mjs
HighShellbin/bin.bundle.mjs
HighSame File Env Network Executiondist/cli.js
HighCredential Redirect Persistencedist/cli.js
HighSandbox Evasion Gated Capabilitydist/cli.js
HighCross File Remote Execution Contextdist/cli.js
HighRuntime Package Installdist/cli.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperbin/pre-tool-use-filter.sh
MediumStructural Risk Force Deep Review
LowScripts Present
Affected versions and remediation
This report applies to halfcycle@0.4.17.
See all versions of halfcycle for other recorded verdicts.
- Review the evidence and your use of halfcycle@0.4.17 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.