ravenry-app@0.2.0
A local board for following every Claude Code session on your Mac, answering agents from one page (cmux or iTerm2), and keeping project briefs.
AI Security Review
scanned 10h ago · by lpm-firewall-aiRule suggestions are a legitimate feature using the user's own Claude login, but existing installs with no saved preference are treated as opted in and can send session text automatically. Because this conflicts with the documented opt-in behavior, warn rather than block.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Starting the board when rule suggestions are enabled by the missing-preference default; analysis runs at startup when due and daily while the board is running.
Impact
Session text leaves the Mac for analysis and may use the user's Claude quota without the opt-in described in the README.
Mechanism
The board reads session messages and passes them to claude -p through the user's own Claude login.
AI rationale
Rule suggestions are a legitimate feature using the user's own Claude login, but existing installs with no saved preference are treated as opted in and can send session text automatically. Because this conflicts with the documented opt-in behavior, warn rather than block.
Evidence
bin/ravenry.mjsserver/config.mjsserver/index.mjsserver/repeats.mjsREADME.md~/.claude/projects/<project>/ (session data read)
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- For a normal board with no saved preference, repeatsAuto defaults to enabled.
- Setup treats a missing preference as enabled when a registry exists, so it skips the opt-in prompt for those existing installs.
- When enabled, the board schedules rule analysis on startup and daily.
- The analysis prompt includes text users typed to their sessions.
- The README says rule suggestions are off unless users turn them on, which conflicts with the legacy-install default.
Evidence against
- The feature analyzes session messages to suggest CLAUDE.md rules, so the submitted content is used by the feature.
- The default command uses the user's own Claude login; no Ravenry collector or fixed webhook was identified.
- Fresh setup explains the data use and asks whether to enable rule suggestions.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStrings
Source & flagged code
9 flaggedtools/open-in-iterm.mjsView file
53import path from 'node:path';
L54: import { execFile } from 'node:child_process';
L55: import { fileURLToPath } from 'node:url';
High
Child Process
Package source references child process execution.
tools/open-in-iterm.mjsView on unpkg · L5353import path from 'node:path';
L54: import { execFile } from 'node:child_process';
L55: import { fileURLToPath } from 'node:url';
...
L59: const REPO = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
L60: const env = process.env;
L61: const OSASCRIPT = env.ITERM_OSASCRIPT_BIN || '/usr/bin/osascript';
...
L68: export const portOf = (e = env) => Number(e.PORT || 4600);
L69: export const boardUrl = (port) => `http://localhost:${port}/`;
L70: export const pageName = (port) => (port === 4600 ? 'Ravenry board' : `Ravenry board :${port}`);
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
tools/open-in-iterm.mjsView on unpkg · L53server/handoff.mjsView file
Findings
2 Critical5 High4 Medium5 Low
CriticalCredential Exfiltrationpublic/app.js
CriticalPrevious Version Dangerous Deltabin/ravenry.mjs
HighChild Processtools/open-in-iterm.mjs
HighSame File Env Network Executiontools/open-in-iterm.mjs
HighFixed Authenticated Webhook Data Exfiltrationserver/channels.mjs
HighSandbox Evasion Gated Capabilitybin/ravenry.mjs
HighSemantic Analysis Limitedserver/pictures.mjs#virtual:normalized:round1
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helpertools/iterm-board-split.py
MediumStructural Risk Force Deep Review
LowScripts Present
Low
Affected versions and remediation
This report applies to ravenry-app@0.2.0.
See all versions of ravenry-app for other recorded verdicts.
- Review the evidence and your use of ravenry-app@0.2.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.