registry / specrails-desktop / 2.22.0

specrails-desktop@2.22.0

AI Security Review

scanned 2h ago · by lpm-firewall-ai

No confirmed malicious install-time or import-time attack surface was found. The package is an AI desktop/agent platform with powerful user-invoked agent and MCP setup paths, including permission-skipping Claude fallback and project MCP/plugin writes.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

User runs specrails-desktop commands, starts the desktop server, or installs an in-app plugin/prerequisite.

Impact

Could grant local agents broad project capabilities if the user invokes these features, but inspected source does not show silent exfiltration or unconsented lifecycle persistence.

Mechanism

user-invoked AI agent launcher and MCP/plugin configuration

Attack narrative

A user-invoked CLI can route prompts to a local manager or directly spawn Claude with permissions skipped. The desktop server can prepare MCP configs for its own agent workflows and plugin installation can add a Serena MCP server and Claude agent fragment to a registered project. These are powerful agent-control capabilities, but inspection did not find npm lifecycle delivery, hidden external exfiltration, or silent mutation on package install.

Rationale

The source shows dangerous agent/MCP capabilities, but they are tied to explicit CLI/server/plugin use and package-aligned workflows rather than unconsented install-time control-surface hijacking. Warn is appropriate for residual AI-agent capability risk; publish block is not supported by the inspected files.

Evidence

package.jsoncli/dist/specrails-desktop.jsserver/dist/agent-mcp-config.jsserver/dist/plugins/serena/install.jsserver/dist/plugins/prereq-installer.jsserver/dist/terminal-shell-integration.js~/.specrails/desktop.token~/.specrails/hub.token~/.specrails/manager.pid~/.specrails/desktop.log~/.specrails/agent/<conversationId>/mcp.json.mcp.json.gemini/settings.json.claude/agents/custom-serena.md

Network endpoints5

127.0.0.1:<port>ws://127.0.0.1:<port>astral.sh/uv/install.shastral.sh/uv/install.ps1git+https://github.com/oraios/serena

Decision evidence

public snapshot

AI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

cli/dist/specrails-desktop.js runDirect invokes claude with --dangerously-skip-permissions when manager is absent
server/dist/plugins/serena/install.js can merge mcpServers.serena into project .mcp.json and write .claude/agents/custom-serena.md
server/dist/plugins/prereq-installer.js can run curl|sh or PowerShell installer for uv on explicit prerequisite install
server/dist/agent-mcp-config.js writes per-conversation MCP config under ~/.specrails/agent and may write .mcp.json/.gemini/settings.json in agent cwd

Evidence against

package.json has no npm lifecycle hooks, so no install-time execution found
bin entry cli/dist/specrails-desktop.js only runs after user invokes the CLI
Network use observed is localhost manager APIs plus documented installer/upstream plugin URLs
Tokens are read/written under ~/.specrails for local auth and not sent to external hosts in inspected code
MCP/agent writes are package-aligned and appear app/user-invoked rather than silent foreign control-surface mutation

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareUrlStrings

ManifestNo manifest risk signals triggered.

scanned 565 file(s), 9.19 MB of source, external domains: 127.0.0.1, acme.atlassian.net, astral.sh, bit.ly, bugzilla.mozilla.org, claude.com, cli.github.com, code.google.com, dein-unternehmen.atlassian.net, developer.mozilla.org, developers.google.com, developers.openai.com, docs.astral.sh, drafts.csswg.org, en.wikipedia.org, example.atlassian.net, git-scm.com, github.com, googlechrome.github.io, hacks.mozilla.org, help.yahoo.com, html.spec.whatwg.org, nodejs.org, r12a.github.io, react.dev, reactflow.dev, redux-toolkit.js.org, redux.js.org, registry.npmjs.org, sass-lang.com, schema.org, specrails.dev, stackoverflow.com, sua-empresa.atlassian.net, support.google.com, tools.ietf.org, tu-empresa.atlassian.net, tua-azienda.atlassian.net, votre-entreprise.atlassian.net, wiki.whatwg.org, www.bing.com, www.dmoz.org, www.iana.org, www.ietf.org, www.w3.org, www.whatwg.org, your-company.atlassian.net

Oversized source lightweight scan

client/dist/assets/editor.api2-C3B0tp2x.js3.46 MB file, sampled 256 KB

ChildProcessObfuscatedHighEntropyStringsMinified

client/dist/assets/index-DM6heiGa.js2.01 MB file, sampled 256 KB

FilesystemNetworkChildProcessWebSocketObfuscatedHighEntropyStringsMinifiedUrlStringsreact.devwww.w3.org

client/dist/assets/ts.worker-METxwbDZ.js6.57 MB file, sampled 256 KB

FilesystemNetworkChildProcess

Source & flagged code

6 flagged

server/dist/worktree-overlay.jsView file

Lines 24-64javascript

24 * the whole dir is absent, per-file/per-child when partially present). The

25 * checkout's own content is NEVER overwritten — tracked files always win.

26 * - `agent-memory` is linked like everything else: all runs SHARE agent memory,

27 * exactly matching the pre-isolation shared-cwd semantics (deliberate).

28 * - The providerDir ROOT itself is never linked (a real dir is created) so

29 * nested pipeline worktrees (`.claude/worktrees/**`) stay LOCAL to this

30 * worktree instead of colliding in the shared workspace. The source's

31 * `worktrees` entry is skipped for the same reason.

32 * - `.mcp.json` and the provider instruction file (CLAUDE.md / AGENTS.md /

33 * GEMINI.md) are COPIED (spawn-local), only when the checkout lacks them.

34 * - Windows: junction fallback for dirs, then a dereferencing copy (the

35 * explore-cwd precedent).

36 *

37 * Idempotent + resume-safe: every created entry is recorded in a manifest

38 * (`.sr-rail-overlay.json`, itself overlay-owned) whose UNION across passes is

39 * returned as `createdPaths` — the caller excludes those paths from

40 * `commitWorktree`'s `git add -A` so overlay scaffolding NEVER lands on the

41 * ticket branch / PR. Failures degrade per entry into `warnings` (the spawn

42 * proceeds — a partial surface beats an aborted rail); this function never

43 * throws.

44 */

45const fs_1 = __importDefault(require("fs"));

46const path_1 = __importDefault(require("path"));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

server/dist/worktree-overlay.jsView on unpkg · L44

47/** Overlay manifest filename (worktree root). Overlay-owned + git-excluded. */

48exports.OVERLAY_MANIFEST = '.sr-rail-overlay.json';

49/** providerDir children that must NEVER be linked into a worktree: nested

50 * pipeline worktrees must stay local to THIS worktree (linking would share

51 * them across concurrent rails — collisions). */

52const SKIP_PROVIDER_ENTRIES = new Set(['worktrees']);

53function errMsg(err) {

54 return err instanceof Error ? err.message : String(err);

55}

56/** True when `p` resolves (following symlinks) to a directory. */

57function isDir(p) {

58 try {

59 return fs_1.default.statSync(p).isDirectory();

60 }

61 catch {

62 return false;

63 }

64}

server/dist/terminal-shell-integration.jsView file

Lines 3-43javascript

3 return (mod && mod.__esModule) ? mod : { "default": mod };

4};

5Object.defineProperty(exports, "__esModule", { value: true });

6exports.NO_SHELL_INTEGRATION = void 0;

server/dist/plugins/prereq-installer.jsView file

Lines 1-23javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.installPrerequisite = installPrerequisite;

4const child_process_1 = require("child_process");

5const win_spawn_1 =

client/dist/assets/html.worker-CQP8QQsS.jsView file

29contains invisible/control Unicode U+2060 (word joiner) `,"nexist;":`∄`,"nexists;":`∄`,"Nfr;":`𝔑`,"nfr;":`𝔫`,"ngE;":`≧̸`,"nge;":`≱`,"ngeq;":`≱`,"ngeqq;":`≧̸`,"ngeqslant;":`⩾̸`,"nges;":`⩾̸`,"nGg;":`⋙̸`,"ngsim;":`≵`,"nGt;":`≫⃒`,"ngt;":`≯`,"ngtr;":`≯`,"nGtv;":`≫̸`,"nhArr;":`⇎`,"nharr;":`↮`,"nhpar;"

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

client/dist/assets/html.worker-CQP8QQsS.jsView on unpkg · L29

client/dist/assets/editor.api2-C3B0tp2x.jsView file

•path = client/dist/assets/editor.api2-C3B0tp2x.js kind = oversized_source_file sizeBytes = 3626915 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

client/dist/assets/editor.api2-C3B0tp2x.jsView on unpkg

server/dist/file-provenance.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = specrails-desktop@2.21.0 matchedIdentity = npm:c3BlY3JhaWxzLWRlc2t0b3A:2.21.0 similarity = 0.758 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

server/dist/file-provenance.jsView on unpkg

Source & flagged code

6 flagged · loading source

server/dist/worktree-overlay.jsView file

44*/ L45: const fs_1 = __importDefault(require("fs")); L46: const path_1 = __importDefault(require("path"));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

server/dist/worktree-overlay.jsView on unpkg · L44

server/dist/terminal-shell-integration.jsView file

23* Resolve the shell basename for our switch logic. We accept full paths or bare L24: * basenames (e.g. "/bin/zsh", "C:\\Program Files\\PowerShell\\7\\pwsh.exe"). L25: */ ... L34: const candidates = [ L35: path_1.default.resolve(__dirname, 'shell-integration', name), L36: // Desktop bundle: shims ship under binaries/shell-integration (declared in ... L88: return exports.NO_SHELL_INTEGRATION; L89: const userZdotdirZshrc = path_1.default.join(shimDir, '.zshrc'); L90: const shimContent = `# Specrails auto-generated zsh entry — do not edit\nsource '${bundled.replace(/'/g, `'\\''`)}'\n`; ... L96: // zsh skip the login files and lose PATH/Homebrew/nvm setup. L97: env: { ZDOTDIR: shimDir, SPECRAILS_REAL_ZDOTDIR: process.env.ZDOTDIR ?? '' }, L98: shimDir,

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

server/dist/terminal-shell-integration.jsView on unpkg · L23

server/dist/plugins/prereq-installer.jsView file

3exports.installPrerequisite = installPrerequisite; L4: const child_process_1 = require("child_process"); L5: const win_spawn_1 = require("../util/win-spawn"); ... L13: return null; L14: if (process.platform === 'darwin' || process.platform === 'linux') { L15: return { L16: label: 'Astral uv installer (curl)', L17: shell: 'curl -LsSf https://astral.sh/uv/install.sh | sh', L18: }; ... L31: /** L32: * Run the platform-appropriate installer for `name` and stream stdout+stderr L33: * to `broadcast` as `plugin.prereq_install_progress` events. Resolves once the

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

server/dist/plugins/prereq-installer.jsView on unpkg · L3

client/dist/assets/html.worker-CQP8QQsS.jsView file

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

client/dist/assets/html.worker-CQP8QQsS.jsView on unpkg · L29

client/dist/assets/editor.api2-C3B0tp2x.jsView file

•path = client/dist/assets/editor.api2-C3B0tp2x.js kind = oversized_source_file sizeBytes = 3626915 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

client/dist/assets/editor.api2-C3B0tp2x.jsView on unpkg

server/dist/file-provenance.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

server/dist/file-provenance.jsView on unpkg

Findings

1 Critical3 High6 Medium5 Low

CriticalTrojan Source Unicodeclient/dist/assets/html.worker-CQP8QQsS.js

HighSandbox Evasion Gated Capabilityserver/dist/plugins/prereq-installer.js

HighOversized Source Fileclient/dist/assets/editor.api2-C3B0tp2x.js

HighPrevious Version Dangerous Deltaserver/dist/file-provenance.js

MediumDynamic Requireserver/dist/worktree-overlay.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistenceserver/dist/terminal-shell-integration.js

MediumProtestware

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

6 flagged

server/dist/worktree-overlay.jsView file

Lines 24-64javascript

24 * the whole dir is absent, per-file/per-child when partially present). The

25 * checkout's own content is NEVER overwritten — tracked files always win.

26 * - `agent-memory` is linked like everything else: all runs SHARE agent memory,

27 * exactly matching the pre-isolation shared-cwd semantics (deliberate).

28 * - The providerDir ROOT itself is never linked (a real dir is created) so

29 * nested pipeline worktrees (`.claude/worktrees/**`) stay LOCAL to this

30 * worktree instead of colliding in the shared workspace. The source's

31 * `worktrees` entry is skipped for the same reason.

32 * - `.mcp.json` and the provider instruction file (CLAUDE.md / AGENTS.md /

33 * GEMINI.md) are COPIED (spawn-local), only when the checkout lacks them.

34 * - Windows: junction fallback for dirs, then a dereferencing copy (the

35 * explore-cwd precedent).

36 *

37 * Idempotent + resume-safe: every created entry is recorded in a manifest

38 * (`.sr-rail-overlay.json`, itself overlay-owned) whose UNION across passes is

39 * returned as `createdPaths` — the caller excludes those paths from

40 * `commitWorktree`'s `git add -A` so overlay scaffolding NEVER lands on the

41 * ticket branch / PR. Failures degrade per entry into `warnings` (the spawn

42 * proceeds — a partial surface beats an aborted rail); this function never

43 * throws.

44 */

45const fs_1 = __importDefault(require("fs"));

46const path_1 = __importDefault(require("path"));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

server/dist/worktree-overlay.jsView on unpkg · L44

47/** Overlay manifest filename (worktree root). Overlay-owned + git-excluded. */

48exports.OVERLAY_MANIFEST = '.sr-rail-overlay.json';

49/** providerDir children that must NEVER be linked into a worktree: nested

50 * pipeline worktrees must stay local to THIS worktree (linking would share

51 * them across concurrent rails — collisions). */

52const SKIP_PROVIDER_ENTRIES = new Set(['worktrees']);

53function errMsg(err) {

54 return err instanceof Error ? err.message : String(err);

55}

56/** True when `p` resolves (following symlinks) to a directory. */

57function isDir(p) {

58 try {

59 return fs_1.default.statSync(p).isDirectory();

60 }

61 catch {

62 return false;

63 }

64}

server/dist/terminal-shell-integration.jsView file

Lines 3-43javascript

3 return (mod && mod.__esModule) ? mod : { "default": mod };

4};

5Object.defineProperty(exports, "__esModule", { value: true });

6exports.NO_SHELL_INTEGRATION = void 0;

server/dist/plugins/prereq-installer.jsView file

Lines 1-23javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.installPrerequisite = installPrerequisite;

4const child_process_1 = require("child_process");

5const win_spawn_1 =

client/dist/assets/html.worker-CQP8QQsS.jsView file

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

client/dist/assets/html.worker-CQP8QQsS.jsView on unpkg · L29

client/dist/assets/editor.api2-C3B0tp2x.jsView file

•path = client/dist/assets/editor.api2-C3B0tp2x.js kind = oversized_source_file sizeBytes = 3626915 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

client/dist/assets/editor.api2-C3B0tp2x.jsView on unpkg

server/dist/file-provenance.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

server/dist/file-provenance.jsView on unpkg