runlot@0.1.0-rc.92
runlot CLI — deploy apps and manage PostgreSQL
AI Security Review
scanned 1mo ago · by lpm-firewall-airunlot is a user-invoked deploy CLI with no npm lifecycle hooks. The agent-config hint only prints setup text, and the session token is used only against the configured package API.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Explicit user invocation of the runlot CLI, including runlot mcp install.
Impact
No unconsented agent-config write, credential forwarding to an unrelated host, or lifecycle mutation of the consumer project was found.
Mechanism
mcp install prints a JSON snippet and a path string. Requests attach the stored or environment token as a Bearer header to the configured API base URL.
AI rationale
runlot is a user-invoked deploy CLI with no npm lifecycle hooks. The agent-config hint only prints setup text, and the session token is used only against the configured package API.
Decision evidence
public snapshotAI called this Clean at 90.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json exposes only the user-invoked bin runlot at dist/index.js, and its scripts are build, test, and typecheck with no install lifecycle hook.
- configPath returns display strings for Claude Code, Cursor, and Claude Desktop config locations and does not write those files.
- The explicit runlot mcp install command prints installText for a named client and then returns.
- The API origin comes from RUNLOT_API_URL, saved credentials, or https://dash.runlot.io, and the session token is sent only as a Bearer header on fetch requests to that base URL.
Evidence against
- Crash reporting posts a scrubbed stack and command name to a Sentry ingest host unless RUNLOT_TELEMETRY or DO_NOT_TRACK disables it.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
10 flaggeddist/index.jsView file
44function gitQuery(ref, path) {
L45: const q = new URLSearchParams();
L46: if (ref !== "") q.set("ref", ref);
...
L87: async request(method, path, init) {
L88: const res = await fetch(new URL(path, this.opts.baseUrl), {
L89: ...init,
...
L95: try {
L96: body = await res.json();
L97: } catch {
...
L928: * hostname (the original request went there), and the server derives the org
L929: * and project names from it. Doing `location.replace` with the `redirect` that
L930: * comes back is the caller's job.
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/index.jsView on unpkg · L4444function gitQuery(ref, path) {
L45: const q = new URLSearchParams();
L46: if (ref !== "") q.set("ref", ref);
...
L87: async request(method, path, init) {
L88: const res = await fetch(new URL(path, this.opts.baseUrl), {
L89: ...init,
...
L95: try {
L96: body = await res.json();
L97: } catch {
...
L928: * hostname (the original request went there), and the server derives the org
L929: * and project names from it. Doing `location.replace` with the `redirect` that
L930: * comes back is the caller's job.
Critical
Remote Response Code Execution
Source passes code obtained from a remote response into a dynamic execution sink.
dist/index.jsView on unpkg · L44Findings
3 Critical5 High4 Medium6 Low
CriticalCredential Exfiltrationdist/index.js
CriticalRemote Response Code Executiondist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
HighChild Processdist/index.js
HighEvaldist/index.js
HighCredential Redirect Persistencedist/index.js
HighCommand Output Exfiltrationdist/index.js
HighTrigger Reachable Credential Exfiltrationdist/index.js
MediumDynamic Requiredist/index.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
Affected versions and remediation
This report applies to runlot@0.1.0-rc.92.
See all versions of runlot for other recorded verdicts.
- Review the evidence and your use of runlot@0.1.0-rc.92 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.