solvit-cli@0.4.2
Solve or fix a coding file from your terminal using any OpenAI-compatible LLM endpoint.
AI Security Review
scanned 8d ago · by lpm-firewall-aiThe fallback can forward an environment-held API key to a package-selected endpoint when no endpoint is configured. Source does not establish an unrelated recipient or malicious intent, so this warrants a warning rather than a block.
Decision evidence
public snapshot- When no endpoint is configured, the solver selects the bundled endpoint but prefers an environment-held SOLVIT_API_KEY; its request sends that key as a bearer token.
- Chat credentials are entered for login or signup and sent to the server selected from configuration, saved settings, the built-in service, or an interactive prompt; the session token is saved locally with restrictive permissions.
- The manifest exposes the CLI entrypoint and declares no install lifecycle hook.
- The bundled endpoint is part of the CLI’s solver and chat service configuration, and source does not establish that it is unrelated to the package.
- The README instructs users to configure the solver endpoint and API key together; the exposure requires a key to be present while the endpoint is unset.
Source & flagged code
7 flaggedWhen no endpoint is configured, the solver selects the bundled endpoint but prefers an environment-held SOLVIT_API_KEY; its request sends that key as a bearer token.
bin/solvit.jsView on unpkg · L106When no endpoint is configured, the solver selects the bundled endpoint but prefers an environment-held SOLVIT_API_KEY; its request sends that key as a bearer token.
Findings
Affected versions and remediation
This report applies to solvit-cli@0.4.2.
See all versions of solvit-cli for other recorded verdicts.
- Review the evidence and your use of solvit-cli@0.4.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.