tako-cli@0.3.9
Tako CLI — unified launcher for AI coding tools (Claude Code, Codex, Gemini) with multi-agent session management
AI Security Review
scanned 4mo ago · by lpm-firewall-aiSource inspection did not confirm credential exfiltration, install-time malware, or destructive behavior; most network and execution primitives are aligned with an AI coding-tool launcher. The unprompted Claude Code settings write and auth-material import keep this above clean.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Running the tako CLI interactively or invoking installer/update/client-install commands
Impact
Could alter a Claude Code control setting without explicit consent and transmit usage identity metadata; no confirmed credential exfiltration or malware payload was found.
Mechanism
AI tool launcher with telemetry, local auth import, package-manager installs, and Claude statusline configuration write
Policy narrative
On normal CLI use, tako imports local Claude/Codex provider state into its own config, may send telemetry identity metadata, and writes Claude Code statusLine to call `tako statusline`. These are plausible product features for an AI-tool launcher, but the silent Claude settings mutation is a real AI-agent control-surface risk that warrants a warning rather than a clean verdict.
AI rationale
Source inspection did not confirm credential exfiltration, install-time malware, or destructive behavior; most network and execution primitives are aligned with an AI coding-tool launcher. The unprompted Claude Code settings write and auth-material import keep this above clean.
Evidence
package.jsondist/index.jsinstall.shinstall.ps1~/.tako/config.json~/.tako/tools~/.tako/cli~/.tako/bin/tako~/.claude/settings.json~/.claude/.credentials.json~/.codex/auth.json
Network endpoints12
op.shiroha.tech/apitako.shiroha.techregistry.npmjs.orgregistry.npmmirror.com
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 78.0% confidence with medium false-positive risk.
Evidence for policy risk
- dist/index.js writes Claude Code settings statusLine to run the Tako statusline command on normal interactive launch
- dist/index.js reads local Claude and Codex auth state and stores provider authData in Tako config for launcher use
- dist/index.js enables selected dangerous flags for Claude/Codex when saved options include skip-permissions or bypass-sandbox
- dist/index.js sends telemetry/identify events, including email when available, to https://op.shiroha.tech/api
Evidence against
- package.json has no install/postinstall hook; prepublishOnly is publisher-side build only
- install.sh/install.ps1 are explicit user-run installers for Bun and tako-cli, not npm lifecycle execution
- Runtime package installs are user-invoked update/install flows under ~/.tako/tools or ~/.tako/cli
- Provider Authorization headers are used for configured model/quota/announcement APIs, not broad env dumping
- No evidence of destructive behavior, persistence beyond user PATH/wrapper setup, or arbitrary remote code payloads
Behavioral surface
ChildProcess
Source & flagged code
8 flaggeddist/index.jsView file
2// @bun
L3: var _k=Object.create;var{getPrototypeOf:mk,defineProperty:fF,getOwnPropertyNames:t7,getOwnPropertyDescriptor:hk}=Object,e7=Object.prototype.hasOwnProperty;function AL(B){return thi...
L4: `);return{update(F){if(F===g)return;if(g=F,I)C(`\r\x1B[2K\u23F3 ${F}`);else C(`\u23F3 ${F}
...
L18: 3. You might have more than one copy of React in the same app
L19: See https://react.dev/link/invalid-hook-call for tips about how to debug and fix this problem.`),K}function qA(){mA.asyncTransitions--}function JA(K){if(u0===null)try{var _=("requi...
L20: `+P.replace(/^Error(:[^\n]*)?\n/,""))});return O.prototype=Object.create(Z.prototype),O.prototype.constructor=O,O.prototype.toString=function(){return this.message===void 0?this.na...
...
L26: `){if(N)g+=Ju("");if(F&&z)g+=Hu(z)}else if(Y===
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/index.jsView on unpkg · L22Trigger-reachable chain: manifest.bin -> dist/index.js
L2: // @bun
L3: var _k=Object.create;var{getPrototypeOf:mk,defineProperty:fF,getOwnPropertyNames:t7,getOwnPropertyDescriptor:hk}=Object,e7=Object.prototype.hasOwnProperty;function AL(B){return thi...
L4: `);return{update(F){if(F===g)return;if(g=F,I)C(`\r\x1B[2K\u23F3 ${F}`);else C(`\u23F3 ${F}
...
L18: 3. You might have more than one copy of React in the same app
L19: See https://react.dev/link/invalid-hook-call for tips about how to debug and fix this problem.`),K}function qA(){mA.asyncTransitions--}function JA(K){if(u0===null)try{var _=("requi...
L20: `+P.replace(/^Error(:[^\n]*)?\n/,""))});return O.prototype=Object.create(Z.prototype),O.prototype.constructor=O,O.prototype.toString=function(){return this.message===void 0?this.na...
.
Findings
2 Critical5 High5 Medium6 Low
CriticalCredential Exfiltrationdist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
HighChild Processdist/index.js
HighSame File Env Network Executiondist/index.js
HighCommand Output Exfiltrationdist/index.js
HighSandbox Evasion Gated Capabilitydist/index.js
HighRuntime Package Installdist/index.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperinstall.sh
MediumStructural Risk Force Deep Review
MediumWildcard Dependency
LowNon Install Lifecycle Scripts
Low
Affected versions and remediation
This report applies to tako-cli@0.3.9.
See all versions of tako-cli for other recorded verdicts.
- Review the evidence and your use of tako-cli@0.3.9 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.