tako-cli@0.3.10
Tako CLI — unified launcher for AI coding tools (Claude Code, Codex, Gemini) with multi-agent session management
AI Security Review
scanned 4mo ago · by lpm-firewall-aiStatic inspection found high-risk primitives, but they are tied to explicit installer/CLI workflows for a unified AI-coding-tool launcher and no concrete unconsented exfiltration, persistence, destructive action, or install-time payload was confirmed. Scanner credential-exfiltration and runtime-install labels appear noisy because the observed flows are package-aligned provider detection, telemetry/API usage, and self/client updates.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
User runs installer or tako CLI commands.
Impact
Installs/updates Tako and supported AI clients, stores provider config, and launches selected tools.
Mechanism
User-invoked AI CLI launcher and updater
AI rationale
Static inspection found high-risk primitives, but they are tied to explicit installer/CLI workflows for a unified AI-coding-tool launcher and no concrete unconsented exfiltration, persistence, destructive action, or install-time payload was confirmed. Scanner credential-exfiltration and runtime-install labels appear noisy because the observed flows are package-aligned provider detection, telemetry/API usage, and self/client updates.
Evidence
package.jsondist/index.jsinstall.shinstall.ps1$HOME/.tako/config.json$HOME/.tako/tools$HOME/.tako/cli$HOME/.tako/bin/tako$HOME/.claude/settings.json$HOME/.claude/.credentials.json$HOME/.claude.json$HOME/.codex/auth.json
Network endpoints11
tako.shiroha.techapi.deepseek.comapi.xiaomimimo.comtoken-plan-cn.xiaomimimo.comregistry.npmjs.orgregistry.npmmirror.combun.sh/install/oven-sh/bun/releases/latest/download
Decision evidence
public snapshotAI called this Clean at 82.0% confidence as Benign with medium false-positive risk.
Evidence for AI clean decision
- dist/index.js can read Claude/Codex auth files during subscription provider detection.
- dist/index.js can write Claude statusLine config at runtime and add dangerous launch flags when user selected.
- install.sh/install.ps1 download Bun and install tako-cli on explicit installer execution.
Evidence against
- package.json has no install/postinstall hook; only prepublishOnly build script.
- Network calls are package-aligned: model/quota/announcement APIs, npm registries, Bun downloads, geo mirror selection.
- Credential material read from local AI tools is stored/used as provider authData for launching supported clients; no confirmed exfiltration flow found.
- Runtime package installs/updates target tako-cli or supported AI client packages under ~/.tako.
- Dangerous Claude/Codex flags are gated by remembered user option selection, not silently forced.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetwork
Source & flagged code
8 flaggeddist/index.jsView file
2// @bun
L3: var xk=Object.create;var{getPrototypeOf:pk,defineProperty:bF,getOwnPropertyNames:e7,getOwnPropertyDescriptor:ik}=Object,AL=Object.prototype.hasOwnProperty;function BL(B){return thi...
L4: `);return{update(F){if(F===g)return;if(g=F,I)C(`\r\x1B[2K\u23F3 ${F}`);else C(`\u23F3 ${F}
...
L10: `,{mode:384})}async function oz(){let B=$L?await dz():await lz(),I;try{let C=await import("fs/promises"),g=JSON.parse(await C.readFile(vN,"utf-8"));if(g.oauthAccount&&typeof g.oaut...
L11: `)}}var kL="Claude Code-credentials",OL,SL,vN,$L;var hw=c(()=>{OL=_N(qL(),".claude"),SL=_N(OL,".credentials.json"),vN=_N(qL(),".claude.json"),$L=xz()==="darwin"});var yL={};F0(yL,{...
L12:
...
L22: 3. You might have more than one copy of React in the same app
L23: See https://react.dev/link/invalid-hook-c
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/index.jsView on unpkg · L22Trigger-reachable chain: manifest.bin -> dist/index.js
L2: // @bun
L3: var xk=Object.create;var{getPrototypeOf:pk,defineProperty:bF,getOwnPropertyNames:e7,getOwnPropertyDescriptor:ik}=Object,AL=Object.prototype.hasOwnProperty;function BL(B){return thi...
L4: `);return{update(F){if(F===g)return;if(g=F,I)C(`\r\x1B[2K\u23F3 ${F}`);else C(`\u23F3 ${F}
...
L10: `,{mode:384})}async function oz(){let B=$L?await dz():await lz(),I;try{let C=await import("fs/promises"),g=JSON.parse(await C.readFile(vN,"utf-8"));if(g.oauthAccount&&typeof g.oaut...
L11: `)}}var kL="Claude Code-credentials",OL,SL,vN,$L;var hw=c(()=>{OL=_N(qL(),".claude"),SL=_N(OL,".credentials.json"),vN=_N(qL(),".claude.json"),$L=xz()==="darwin"});var yL={};F0(yL,{...
L12:
...
L22: 3. You might have more than one copy of React in the
Findings
2 Critical5 High5 Medium6 Low
CriticalCredential Exfiltrationdist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
HighChild Processdist/index.js
HighSame File Env Network Executiondist/index.js
HighCommand Output Exfiltrationdist/index.js
HighSandbox Evasion Gated Capabilitydist/index.js
HighRuntime Package Installdist/index.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperinstall.sh
MediumStructural Risk Force Deep Review
MediumWildcard Dependency
LowNon Install Lifecycle Scripts
Low
Affected versions and remediation
This report applies to tako-cli@0.3.10.
See all versions of tako-cli for other recorded verdicts.
- Review the evidence and your use of tako-cli@0.3.10 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.