registry / specrails-desktop / 2.20.1

specrails-desktop@2.20.1

AI Security Review

scanned 2d ago · by lpm-firewall-ai

No confirmed malicious attack surface is established. The high-risk primitives are runtime features of a desktop AI-agent manager and are activated by user CLI/server actions rather than install/import.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

User runs specrails-desktop commands, starts the desktop manager, activates plugins, or applies agent refinements.

Impact

Local project files and app-managed ~/.specrails state may be modified as part of expected workflows; no unconsented malicious impact confirmed.

Mechanism

User-invoked local AI CLI orchestration, MCP config generation, prerequisite installer, and shell integration shims

Rationale

Static inspection shows dangerous capabilities, but they are package-aligned desktop manager workflows gated by user actions and local server/API context, with no install-time execution or covert exfiltration. Scanner hints map to legitimate bundled app behavior rather than a concrete malicious payload.

Evidence

package.jsoncli/dist/specrails-desktop.jsserver/dist/agent-refine-manager.jsserver/dist/plugins/prereq-installer.jsserver/dist/terminal-shell-integration.jsserver/dist/browser-context-pool.jsserver/dist/agent-mcp-config.jsserver/dist/user-mcp-config.jsserver/dist/plugins-router.js~/.specrails/desktop.token~/.specrails/hub.token~/.specrails/manager.pid~/.specrails/desktop.log~/.specrails/projects/<slug>/terminals/<sessionId><project>/.claude/agents/<agentId>.md<project>/.codex/skills/<agentId>/SKILL.md<workspace>/.mcp.json~/.specrails/agent/<conversationId>/mcp.json~/.specrails/projects/<slug>/user-mcp.json

Network endpoints4

127.0.0.1:<port>ws://127.0.0.1:<port>astral.sh/uv/install.shastral.sh/uv/install.ps1

Decision evidence

public snapshot

AI called this Clean at 87.0% confidence as Benign with medium false-positive risk.

Evidence for block

cli/dist/specrails-desktop.js can spawn the local claude CLI with --dangerously-skip-permissions when the user runs a command and no manager is reachable.
server/dist/agent-refine-manager.js can spawn AI CLI turns and write refined custom agent files under .claude/agents or .codex/skills after an apply action.
server/dist/plugins/prereq-installer.js contains explicit uv installers using curl/PowerShell from https://astral.sh/uv/install.* when prerequisite install is requested.

Evidence against

package.json has no install/preinstall/postinstall lifecycle hooks; bin points to cli/dist/specrails-desktop.js only.
Network activity inspected is local manager HTTP/WebSocket on 127.0.0.1 plus package-aligned user-requested installers and configured Jira/mobile endpoints.
server/dist/terminal-shell-integration.js writes per-session shell shims under ~/.specrails only when terminal shell integration is enabled, with cleanup for stale dirs.
server/dist/user-mcp-config.js reads user-approved Claude MCP config and writes scoped copies under ~/.specrails; comments and code show this is gated by chat context/provider.
server/dist/agent-mcp-config.js injects a specrails MCP bridge for app control without embedding tokens in config files.
No evidence found of import-time execution, credential harvesting, external exfiltration, persistence hooks, or destructive behavior.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareUrlStrings

ManifestNo manifest risk signals triggered.

scanned 549 file(s), 10.5 MB of source, external domains: 127.0.0.1, acme.atlassian.net, astral.sh, bit.ly, bugzilla.mozilla.org, claude.com, code.google.com, dein-unternehmen.atlassian.net, developer.mozilla.org, developers.google.com, developers.openai.com, docs.astral.sh, drafts.csswg.org, en.wikipedia.org, example.atlassian.net, git-scm.com, github.com, googlechrome.github.io, hacks.mozilla.org, help.yahoo.com, html.spec.whatwg.org, nodejs.org, r12a.github.io, radix-ui.com, react.dev, reactflow.dev, reactrouter.com, redux-toolkit.js.org, redux.js.org, registry.npmjs.org, sass-lang.com, schema.org, specrails.dev, stackoverflow.com, sua-empresa.atlassian.net, support.google.com, tools.ietf.org, tu-empresa.atlassian.net, tua-azienda.atlassian.net, votre-entreprise.atlassian.net, wiki.whatwg.org, www.bing.com, www.dmoz.org, www.iana.org, www.ietf.org, www.w3.org, www.whatwg.org, your-company.atlassian.net

Oversized source lightweight scan

client/dist/assets/editor.api2-T7u8kQWG.js3.46 MB file, sampled 256 KB

ChildProcessObfuscatedHighEntropyStringsMinified

client/dist/assets/ts.worker-METxwbDZ.js6.57 MB file, sampled 256 KB

FilesystemNetworkChildProcess

Source & flagged code

6 flagged

server/dist/browser-context-pool.jsView file

Lines 1-37javascript

1"use strict";

2// App-wide owner of a SINGLE persistent Chromium context for "Add Spec from a

3// website". Its profile (cookies, logins, localStorage) lives in ONE GLOBAL dir

4// under $HOME, so the captured browser shares its session across every project —

5// log in once, and any project's capture window sees those cookies.

6//

7// Why a shared singleton (not per-project): a persistent Chromium profile takes

8// an EXCLUSIVE on-disk lock, so exactly one context may open a given userDataDir.

9// Pointing every project at one global dir therefore REQUIRES a single shared

10// context; each per-project BrowserCaptureManager opens its own pages in it

11// (pages are isolated enough for capture, cookies are shared). The context is

12// launched lazily on first use and closed once at app shutdown.

13var __importDefault = (this && this.__importDefault) || function (mod) {

14 return (mod && mod.__esModule) ? mod : { "default": mod };

15};

16Object.defineProperty(exports, "__esModule", { value: true });

17exports.SharedBrowserContextPool = void 0;

18const os_1 = __importDefault(require("os"));

19const path_1 = __importDefault(require("path"));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

server/dist/browser-context-pool.jsView on unpkg · L17

20const browser_capture_types_1 = require("./browser-capture-types");

21const browser_playwright_1 = require("./browser-playwright");

22const DEFAULT_VIEWPORT = { width: 1280, height: 800 };

23class SharedBrowserContextPool {

24 launcher;

25 _profileDir;

26 context = null;

27 contextPromise = null;

28 disposed = false;

29 constructor(opts = {}) {

30 this.launcher = opts.launcher ?? (0, browser_playwright_1.createPlaywrightLauncher)();

31 this._profileDir =

32 opts.profileDir ?? path_1.default.join(opts.homeDir ?? os_1.default.homedir(), '.specrails', 'browser-profile');

33 }

34 /** The global profile dir backing the shared cookies/logins. */

35 get profileDir() {

36 return this._profileDir;

37 }

server/dist/terminal-shell-integration.jsView file

Lines 3-43javascript

3 return (mod && mod.__esModule) ? mod : { "default": mod };

4};

5Object.defineProperty(exports, "__esModule", { value: true });

6exports.NO_SHELL_INTEGRATION = void 0;

server/dist/plugins/prereq-installer.jsView file

Lines 1-23javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.installPrerequisite = installPrerequisite;

4const child_process_1 = require("child_process");

5const win_spawn_1 =

client/dist/assets/html.worker-CQP8QQsS.jsView file

29contains invisible/control Unicode U+2060 (word joiner) `,"nexist;":`∄`,"nexists;":`∄`,"Nfr;":`𝔑`,"nfr;":`𝔫`,"ngE;":`≧̸`,"nge;":`≱`,"ngeq;":`≱`,"ngeqq;":`≧̸`,"ngeqslant;":`⩾̸`,"nges;":`⩾̸`,"nGg;":`⋙̸`,"ngsim;":`≵`,"nGt;":`≫⃒`,"ngt;":`≯`,"ngtr;":`≯`,"nGtv;":`≫̸`,"nhArr;":`⇎`,"nharr;":`↮`,"nhpar;"

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

client/dist/assets/html.worker-CQP8QQsS.jsView on unpkg · L29

client/dist/assets/ts.worker-METxwbDZ.jsView file

•path = client/dist/assets/ts.worker-METxwbDZ.js kind = oversized_source_file sizeBytes = 6894230 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

client/dist/assets/ts.worker-METxwbDZ.jsView on unpkg

server/dist/agent-refine-manager.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = specrails-desktop@2.20.0 matchedIdentity = npm:c3BlY3JhaWxzLWRlc2t0b3A:2.20.0 similarity = 0.833 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

server/dist/agent-refine-manager.jsView on unpkg

Source & flagged code

6 flagged · loading source

server/dist/browser-context-pool.jsView file

17exports.SharedBrowserContextPool = void 0; L18: const os_1 = __importDefault(require("os")); L19: const path_1 = __importDefault(require("path"));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

server/dist/browser-context-pool.jsView on unpkg · L17

server/dist/terminal-shell-integration.jsView file

23* Resolve the shell basename for our switch logic. We accept full paths or bare L24: * basenames (e.g. "/bin/zsh", "C:\\Program Files\\PowerShell\\7\\pwsh.exe"). L25: */ ... L34: const candidates = [ L35: path_1.default.resolve(__dirname, 'shell-integration', name), L36: // Desktop bundle: shims ship under binaries/shell-integration (declared in ... L88: return exports.NO_SHELL_INTEGRATION; L89: const userZdotdirZshrc = path_1.default.join(shimDir, '.zshrc'); L90: const shimContent = `# Specrails auto-generated zsh entry — do not edit\nsource '${bundled.replace(/'/g, `'\\''`)}'\n`; ... L96: // zsh skip the login files and lose PATH/Homebrew/nvm setup. L97: env: { ZDOTDIR: shimDir, SPECRAILS_REAL_ZDOTDIR: process.env.ZDOTDIR ?? '' }, L98: shimDir,

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

server/dist/terminal-shell-integration.jsView on unpkg · L23

server/dist/plugins/prereq-installer.jsView file

3exports.installPrerequisite = installPrerequisite; L4: const child_process_1 = require("child_process"); L5: const win_spawn_1 = require("../util/win-spawn"); ... L13: return null; L14: if (process.platform === 'darwin' || process.platform === 'linux') { L15: return { L16: label: 'Astral uv installer (curl)', L17: shell: 'curl -LsSf https://astral.sh/uv/install.sh | sh', L18: }; ... L31: /** L32: * Run the platform-appropriate installer for `name` and stream stdout+stderr L33: * to `broadcast` as `plugin.prereq_install_progress` events. Resolves once the

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

server/dist/plugins/prereq-installer.jsView on unpkg · L3

client/dist/assets/html.worker-CQP8QQsS.jsView file

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

client/dist/assets/html.worker-CQP8QQsS.jsView on unpkg · L29

client/dist/assets/ts.worker-METxwbDZ.jsView file

•path = client/dist/assets/ts.worker-METxwbDZ.js kind = oversized_source_file sizeBytes = 6894230 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

client/dist/assets/ts.worker-METxwbDZ.jsView on unpkg

server/dist/agent-refine-manager.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

server/dist/agent-refine-manager.jsView on unpkg

Findings

1 Critical3 High6 Medium5 Low

CriticalTrojan Source Unicodeclient/dist/assets/html.worker-CQP8QQsS.js

HighSandbox Evasion Gated Capabilityserver/dist/plugins/prereq-installer.js

HighOversized Source Fileclient/dist/assets/ts.worker-METxwbDZ.js

HighPrevious Version Dangerous Deltaserver/dist/agent-refine-manager.js

MediumDynamic Requireserver/dist/browser-context-pool.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistenceserver/dist/terminal-shell-integration.js

MediumProtestware

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings