halfcycle@0.4.5
Your coding agents are the engineers. Halfcycle is the rest of the team: product owner, architect, planner and independent reviewer for Claude Code.
AI Security Review
scanned 12d ago · by lpm-firewall-aiCredential forwarding to an unrestricted, configured endpoint creates a conditional exposure risk even though the default origin is package-aligned and the transfer occurs during user-invoked operations. This supports a warning, not a block.
Static reason
One or more suspicious static signals were detected.
Trigger
A user runs a credentialed CLI operation while HALFCYCLE_SERVICE_URL is set.
Impact
The configured endpoint can receive the account credential; no malicious recipient or covert default transfer was established.
Mechanism
The CLI resolves the environment value as its service origin, obtains a credential, and sends it in a bearer authorization header on service requests.
AI rationale
Credential forwarding to an unrestricted, configured endpoint creates a conditional exposure risk even though the default origin is package-aligned and the transfer occurs during user-invoked operations. This supports a warning, not a block.
Evidence
dist/cli.jsdist/index.js
Network endpoints2
control.halfcycle.aiHALFCYCLE_SERVICE_URL
Decision evidence
public snapshotAI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The CLI accepts HALFCYCLE_SERVICE_URL as its service origin without a host restriction, and its install/setup path uses that resolved origin.
- The CLI can load an existing saved credential and attach it as a bearer token to requests sent to the selected origin.
- Credentialed requests include user-invoked engagement setup, phase, and build-record operations; the source does not establish that a custom origin is malicious.
Evidence against
- Without the environment override, the CLI uses https://control.halfcycle.ai.
- The inspected transfer paths are tied to explicit CLI operations; no automatic installation-time credential transfer was identified.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
8 flaggedbin/bin.bundle.mjsView file
15715// dist/git.js
L15716: import { spawnSync } from "node:child_process";
L15717: import { existsSync, readFileSync } from "node:fs";
High
Child Process
Package source references child process execution.
bin/bin.bundle.mjsView on unpkg · L15715dist/cli.jsView file
3216// dist/control-origin.js
L3217: var DEFAULT_CONTROL_ORIGIN = "https://control.halfcycle.ai";
L3218: function resolveControlOrigin(env = process.env) {
L3219: const configured = env["HALFCYCLE_SERVICE_URL"]?.trim();
...
L3228: // dist/device-signin.js
L3229: import { spawn } from "node:child_process";
L3230: import { platform as platform3 } from "node:os";
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/cli.jsView on unpkg · L32163398function defaultWrite(text) {
L3399: process.stdout.write(text);
L3400: }
L3401: function defaultSleep(ms) {
L3402: return new Promise((resolve4) => setTimeout(resolve4, ms));
L3403: }
...
L3408: return {
L3409: command: "cmd.exe",
L3410: args: ["/d", "/s", "/c", `"start "" "${url}""`],
Findings
8 High3 Medium5 Low
HighChild Processbin/bin.bundle.mjs
HighSame File Env Network Executiondist/cli.js
HighCommand Output Exfiltrationdist/cli.js
HighSandbox Evasion Gated Capabilitydist/cli.js
HighCross File Remote Execution Contextdist/cli.js
HighTrigger Reachable Command Output Exfiltrationdist/cli.js
HighRuntime Package Installdist/cli.js
HighSemantic Analysis Limiteddist/index.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowEval
LowFilesystem
Affected versions and remediation
This report applies to halfcycle@0.4.5.
See all versions of halfcycle for other recorded verdicts.
- Review the evidence and your use of halfcycle@0.4.5 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.