tako-cli@0.3.15
Tako CLI — unified launcher for AI coding tools (Claude Code, Codex, Gemini) with multi-agent session management
AI Security Review
scanned 4mo ago · by lpm-firewall-aiStatic inspection supports a warning for agent extension/control-surface risk, not a block: risky writes are runtime or user-invoked and package-aligned, while package installation itself has no postinstall hijack. Scanner credential-exfiltration labels appear to match user API key validation/quota/model calls rather than covert theft.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
User runs installer or invokes `tako`; skill writes require `tako skill install`.
Impact
Warn-level risk from modifying a foreign AI-agent control surface during runtime, but no unconsented lifecycle hijack or credential exfiltration was found.
Mechanism
AI-tool launcher with runtime agent integration and package-owned Claude statusline/skills setup
Policy narrative
The package is a documented launcher for Claude Code, Codex, and Gemini. Its installer creates a private ~/.tako runtime and PATH wrapper, while the CLI can install client packages, configure provider credentials, and integrate with Claude through a statusLine command and optional project skills. These are dangerous agent-facing capabilities, but inspection did not find an npm lifecycle hook that silently mutates Claude/Codex/Cursor surfaces or exfiltrates credentials.
AI rationale
Static inspection supports a warning for agent extension/control-surface risk, not a block: risky writes are runtime or user-invoked and package-aligned, while package installation itself has no postinstall hijack. Scanner credential-exfiltration labels appear to match user API key validation/quota/model calls rather than covert theft.
Evidence
package.jsondist/index.jsinstall.shinstall.ps1README.md~/.tako/config.json~/.tako/bin/tako~/.claude/settings.json.claude/skills/<skill>/SKILL.md~/.bashrc~/.bash_profile~/.zshrc~/.config/fish/config.fish~/.profile
Network endpoints12
tako.shiroha.tech
Decision evidence
public snapshotAI called this Suspicious at 82.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- dist/index.js writes ~/.claude/settings.json statusLine to run ~/.tako/bin/tako statusline on user CLI launch
- dist/index.js can install bundled skills into project .claude/skills via explicit `tako skill install` command
- dist/index.js launches Claude/Codex/Gemini and can add dangerous flags when previously selected by user
- install.sh/install.ps1 download Bun and run `bun add tako-cli`; installer also edits shell PATH files
Evidence against
- package.json has no install/postinstall hook; only prepublishOnly build script
- Network calls are package-aligned: region detection, npm/Bun downloads, Tako API quota/key validation, model metadata, announcements
- No confirmed credential harvesting/exfiltration beyond user-configured provider API key validation/quota calls
- Agent/skill and client install features are documented in README and user-invoked
- No obfuscated staged payload or destructive/persistence behavior found in package files
Behavioral surface
ChildProcessEnvironmentVarsFilesystem
Source & flagged code
8 flaggeddist/index.jsView file
2// @bun
L3: var Nk=Object.create;var{getPrototypeOf:Hk,defineProperty:jF,getOwnPropertyNames:NL,getOwnPropertyDescriptor:Jk}=Object,HL=Object.prototype.hasOwnProperty;function JL(B){return thi...
L4: `);return{update(F){if(F===g)return;if(g=F,I)C(`\r\x1B[2K\u23F3 ${F}`);else C(`\u23F3 ${F}
...
L10: `,{mode:384})}async function KS(){let B=xL?await JS():await MS(),I;try{let C=await import("fs/promises"),g=JSON.parse(await C.readFile(xN,"utf-8"));if(g.oauthAccount&&typeof g.oaut...
L11: `)}}var hL="Claude Code-credentials",bL,jL,xN,xL;var pw=a(()=>{bL=pN(mL(),".claude"),jL=pN(bL,".credentials.json"),xN=pN(mL(),".claude.json"),xL=GS()==="darwin"});var pL={};G0(pL,{...
L12:
...
L22: 3. You might have more than one copy of React in the same app
L23: See https://react.dev/link/invalid-hook-c
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/index.jsView on unpkg · L22Trigger-reachable chain: manifest.bin -> dist/index.js
L2: // @bun
L3: var Nk=Object.create;var{getPrototypeOf:Hk,defineProperty:jF,getOwnPropertyNames:NL,getOwnPropertyDescriptor:Jk}=Object,HL=Object.prototype.hasOwnProperty;function JL(B){return thi...
L4: `);return{update(F){if(F===g)return;if(g=F,I)C(`\r\x1B[2K\u23F3 ${F}`);else C(`\u23F3 ${F}
...
L10: `,{mode:384})}async function KS(){let B=xL?await JS():await MS(),I;try{let C=await import("fs/promises"),g=JSON.parse(await C.readFile(xN,"utf-8"));if(g.oauthAccount&&typeof g.oaut...
L11: `)}}var hL="Claude Code-credentials",bL,jL,xN,xL;var pw=a(()=>{bL=pN(mL(),".claude"),jL=pN(bL,".credentials.json"),xN=pN(mL(),".claude.json"),xL=GS()==="darwin"});var pL={};G0(pL,{...
L12:
...
L22: 3. You might have more than one copy of React in the
Findings
2 Critical5 High5 Medium6 Low
CriticalCredential Exfiltrationdist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
HighChild Processdist/index.js
HighSame File Env Network Executiondist/index.js
HighCommand Output Exfiltrationdist/index.js
HighSandbox Evasion Gated Capabilitydist/index.js
HighRuntime Package Installdist/index.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperinstall.sh
MediumStructural Risk Force Deep Review
MediumWildcard Dependency
LowNon Install Lifecycle Scripts
Low
Affected versions and remediation
This report applies to tako-cli@0.3.15.
See all versions of tako-cli for other recorded verdicts.
- Review the evidence and your use of tako-cli@0.3.15 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.