minimal-forge-work-pack-sync@0.1.35
Minimal Forge Work Pack startup synchronization for OpenCode and OpenWork.
AI Security Review
scanned 17d ago · by lpm-firewall-aiThe plugin forwards a Forge API key to a manifest-selected gateway without checking that the gateway host matches the configured Forge origin. Since the source does not establish that the recipient is unrelated or malicious, this warrants a warning rather than a block.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Enabling the plugin starts synchronization; invoking the Forge image tool sends the request to the selected gateway.
Impact
If the manifest selects a gateway outside the intended Forge service, the key could be disclosed to that recipient; source inspection does not establish gateway ownership.
Mechanism
A manifest-selected HTTPS origin is used as the gateway, and the Forge API key is attached as a bearer token.
AI rationale
The plugin forwards a Forge API key to a manifest-selected gateway without checking that the gateway host matches the configured Forge origin. Since the source does not establish that the recipient is unrelated or malicious, this warrants a warning rather than a block.
Evidence
dist/index.jspackage.jsondist/repair.js
Decision evidence
public snapshotAI called this Suspicious at 82.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- package.json exports dist/index.js as the plugin entrypoint.
- Plugin startup reads Forge credentials and fetches the configured Forge manifest.
- The manifest can select a gateway URL that receives the Forge API key in provider configuration; the gateway check requires HTTPS but does not bind its host to the Forge origin.
- The image tool sends the Forge API key as a bearer token to that gateway.
- The separate recovery flow fetches its manifest from the configured Forge origin and only reenrolls after an explicit action.
Evidence against
- The source does not establish who controls a manifest-selected gateway or show that it is unrelated to the configured Forge service.
- The recovery helper’s credential request goes to the configured Forge origin; its reenrollment path requires an explicit action.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetwork
Source & flagged code
5 flaggeddist/index.jsView file
2615if (typeof node_buffer.Buffer === "function") {
L2616: return node_buffer.Buffer.from(src, "base64");
L2617: } else if (typeof atob === "function") {
...
L5229: yield* this.next(token);
L5230: yield* this.end(forceDoc, endOffset);
L5231: }
...
L5233: *next(token) {
L5234: if (node_process.env.LOG_STREAM)
L5235: console.dir(token, { depth: null });
...
L7613: var FIRECRAWL_KEYLESS_MCP_NAME = "firecrawl";
L7614: var FIRECRAWL_KEYLESS_MCP_URL = "https://mcp.firecrawl.dev/v2/mcp";
L7615: var FIRECRAWL_KEYLESS_PERMISSION = `${FIRECRAWL_KEYLESS_MCP_NAME}_*`;
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/index.jsView on unpkg · L26152615Trigger-reachable chain: manifest.main -> dist/index.js
L2615: if (typeof node_buffer.Buffer === "function") {
L2616: return node_buffer.Buffer.from(src, "base64");
L2617: } else if (typeof atob === "function") {
...
L5229: yield* this.next(token);
L5230: yield* this.end(forceDoc, endOffset);
L5231: }
...
L5233: *next(token) {
L5234: if (node_process.env.LOG_STREAM)
L5235: console.dir(token, { depth: null });
...
L7613: var FIRECRAWL_KEYLESS_MCP_NAME = "firecrawl";
L7614: var FIRECRAWL_KEYLESS_MCP_URL = "https://mcp.firecrawl.dev/v2/mcp";
L7615: var FIRECRAWL_KEYLESS_PERMISSION = `${FIRECRAWL_KEYLESS_MCP_NAME}_*`;
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/index.jsFindings
3 Critical2 High3 Medium5 Low
CriticalCredential Exfiltrationdist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
CriticalPrevious Version Dangerous Deltadist/repair.js
HighCredential Redirect Persistencedist/index.js
HighTrigger Reachable Credential Exfiltrationdist/index.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowEval
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to minimal-forge-work-pack-sync@0.1.35.
See all versions of minimal-forge-work-pack-sync for other recorded verdicts.
- Review the evidence and your use of minimal-forge-work-pack-sync@0.1.35 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.