tako-cli@0.3.14
Tako CLI — unified launcher for AI coding tools (Claude Code, Codex, Gemini) with multi-agent session management
AI Security Review
scanned 4mo ago · by lpm-firewall-aiThe scanner's exfiltration finding appears to conflate configured provider API use and telemetry with credential theft; source inspection did not show install-time execution or concrete data theft. Because the package mutates Claude settings and exposes dangerous agent launch modes, warn rather than mark clean.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
User runs install.sh/install.ps1 or invokes the `tako` CLI
Impact
Potentially risky agent control behavior if users enable dangerous launch options or allow Claude settings/statusline integration, but no unconsented lifecycle hijack or exfiltration is confirmed.
Mechanism
user-invoked AI-agent launcher and first-party integration setup
Policy narrative
A user-invoked install or CLI run sets up Tako under ~/.tako and can configure shell PATH/wrappers. Runtime code may write a Claude statusLine command into Claude settings and can launch AI coding tools with optional dangerous flags if saved options select them. This is risky agent-facing functionality but not npm lifecycle control-surface hijacking or credential exfiltration by static inspection.
AI rationale
The scanner's exfiltration finding appears to conflate configured provider API use and telemetry with credential theft; source inspection did not show install-time execution or concrete data theft. Because the package mutates Claude settings and exposes dangerous agent launch modes, warn rather than mark clean.
Evidence
package.jsoninstall.shinstall.ps1dist/index.jsREADME.md~/.tako/config.json~/.tako/tools~/.tako/cli~/.tako/bin/tako~/.tako/bin/tako.cmd~/.tako/bin/tako.ps1~/.claude/settings.json%APPDATA%/claude/settings.json/usr/local/bin/tako~/.bashrc~/.bash_profile~/.zshrc~/.config/fish/config.fish~/.profile
Network endpoints
Decision evidence
public snapshotAI called this Suspicious at 78.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- dist/index.js writes Claude user settings statusLine to run `tako statusline` on CLI launch
- dist/index.js can add `--dangerously-skip-permissions` for Claude and `--dangerously-bypass-approvals-and-sandbox` for Codex from saved options
- dist/index.js implements agent session commands and package-manager installs/updates for supported AI clients
- install.sh and install.ps1 download Bun and install tako-cli@latest into ~/.tako, then create PATH/wrapper files
Evidence against
- package.json has no install/postinstall/prepare hook; only prepublishOnly build
- Installer scripts are explicit user-invoked install paths, not npm lifecycle execution
- Network calls are mostly package-aligned: registries, Bun downloads, configured providers, telemetry, model/usage endpoints
- No confirmed credential harvesting/exfiltration flow found; provider API keys are used as Authorization for configured provider/model/usage requests
- Dangerous agent flags are gated by CLI state/user option handling, not silently forced on every launch
Behavioral surface
Source & flagged code
8 flaggeddist/index.jsView file
2// @bun
L3: var Gk=Object.create;var{getPrototypeOf:Nk,defineProperty:jF,getOwnPropertyNames:GL,getOwnPropertyDescriptor:Hk}=Object,NL=Object.prototype.hasOwnProperty;function HL(B){return thi...
L4: `);return{update(F){if(F===g)return;if(g=F,I)C(`\r\x1B[2K\u23F3 ${F}`);else C(`\u23F3 ${F}
...
L10: `,{mode:384})}async function LS(){let B=jL?await HS():await US(),I;try{let C=await import("fs/promises"),g=JSON.parse(await C.readFile(xN,"utf-8"));if(g.oauthAccount&&typeof g.oaut...
L11: `)}}var mL="Claude Code-credentials",fL,bL,xN,jL;var pw=a(()=>{fL=pN(VL(),".claude"),bL=pN(fL,".credentials.json"),xN=pN(VL(),".claude.json"),jL=wS()==="darwin"});var xL={};G0(xL,{...
L12:
...
L22: 3. You might have more than one copy of React in the same app
L23: See https://react.dev/link/invalid-hook-c
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/index.jsView on unpkg · L22Trigger-reachable chain: manifest.bin -> dist/index.js
L2: // @bun
L3: var Gk=Object.create;var{getPrototypeOf:Nk,defineProperty:jF,getOwnPropertyNames:GL,getOwnPropertyDescriptor:Hk}=Object,NL=Object.prototype.hasOwnProperty;function HL(B){return thi...
L4: `);return{update(F){if(F===g)return;if(g=F,I)C(`\r\x1B[2K\u23F3 ${F}`);else C(`\u23F3 ${F}
...
L10: `,{mode:384})}async function LS(){let B=jL?await HS():await US(),I;try{let C=await import("fs/promises"),g=JSON.parse(await C.readFile(xN,"utf-8"));if(g.oauthAccount&&typeof g.oaut...
L11: `)}}var mL="Claude Code-credentials",fL,bL,xN,jL;var pw=a(()=>{fL=pN(VL(),".claude"),bL=pN(fL,".credentials.json"),xN=pN(VL(),".claude.json"),jL=wS()==="darwin"});var xL={};G0(xL,{...
L12:
...
L22: 3. You might have more than one copy of React in the
Findings
2 Critical5 High5 Medium6 Low
CriticalCredential Exfiltrationdist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
HighChild Processdist/index.js
HighSame File Env Network Executiondist/index.js
HighCommand Output Exfiltrationdist/index.js
HighSandbox Evasion Gated Capabilitydist/index.js
HighRuntime Package Installdist/index.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperinstall.sh
MediumStructural Risk Force Deep Review
MediumWildcard Dependency
LowNon Install Lifecycle Scripts
Low
Affected versions and remediation
This report applies to tako-cli@0.3.14.
See all versions of tako-cli for other recorded verdicts.
- Review the evidence and your use of tako-cli@0.3.14 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.