wildcrane-runner@0.6.2
WildCrane's Local Runner — connects this computer to WildCrane and runs its jobs on your local Claude Code, Codex, OpenCode or Cursor.
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe package sends default-on runtime usage telemetry from CLI invocations without disclosing it in the package README. The inspected events contain usage and platform metadata, not prompts or credentials, so this warrants a warning rather than a malicious verdict.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
Invoking the CLI; app-open reporting runs before command processing.
Impact
The service receives usage and platform metadata without prior disclosure to CLI users.
Mechanism
Queues usage events with a pseudonymous install ID and sends them in batches to the telemetry endpoint.
AI rationale
The package sends default-on runtime usage telemetry from CLI invocations without disclosing it in the package README. The inspected events contain usage and platform metadata, not prompts or credentials, so this warrants a warning rather than a malicious verdict.
Evidence
dist/akb/dist/kanban.mjs~/.ai4kanban/settings.json~/.ai4kanban/usage-queue.jsonl~/.ai4kanban/usage-state.json
Network endpoints2
t.ai4kanban.dev/v1/batchAI4KANBAN_USAGE_URL (optional endpoint override)
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- CLI startup reports an app-open event on the command surface before processing the command.
- Usage reporting defaults to on when no setting exists; the disclosure gate applies to the desktop surface, not the command surface.
- Reported events include OS and architecture, harness and custom-agent status, and model category and cost.
- Batches are POSTed to https://t.ai4kanban.dev/v1/batch.
- Provider secrets are passed into the selected local agent's environment; I found no evidence that these keys are included in the telemetry.
Evidence against
- The reported fields are usage metadata; the inspected telemetry path does not include prompts, command output, or credential values.
- The CLI provides a telemetry-off setting that drops queued events.
- The package describes itself as a local runner for WildCrane jobs, so its cloud connection and local agent execution match its stated purpose.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVars
Source & flagged code
9 flaggeddist/akb/dist/kanban.mjsView file
58* Constructs the CommanderError class
L59: * @param {number} exitCode suggested exit code which could be used with process.exit
L60: * @param {string} code an id string representing the error
...
L1168: var EventEmitter = __require("node:events").EventEmitter;
L1169: var childProcess = __require("node:child_process");
L1170: var path83 = __require("node:path");
...
L1218: this._outputConfiguration = {
L1219: writeOut: (str5) => process2.stdout.write(str5),
L1220: writeErr: (str5) => process2.stderr.write(str5),
...
L1257: * @returns {Command[]}
L1258: * @private
L1259: */
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/akb/dist/kanban.mjsView on unpkg · L581168var EventEmitter = __require("node:events").EventEmitter;
L1169: var childProcess = __require("node:child_process");
L1170: var path83 = __require("node:path");
High
Child Process
Package source references child process execution.
dist/akb/dist/kanban.mjsView on unpkg · L11682008}
L2009: const execArgv = process2.execArgv ?? [];
L2010: if (execArgv.includes("-e") || execArgv.includes("--eval") || execArgv.includes("-p") || execArgv.includes("--print")) {
Findings
1 Critical5 High5 Medium6 Low
CriticalCredential Exfiltrationdist/akb/dist/kanban.mjs
HighChild Processdist/akb/dist/kanban.mjs
HighShelldist/akb/dist/kanban.mjs
HighSame File Env Network Executiondist/launcher.mjs
HighCommand Output Exfiltrationdist/akb/dist/kanban.mjs
HighKnown Malware Source Similaritydist/akb/dist/kanban.mjs
MediumDynamic Requiredist/akb/bin/ai4kanban.mjs
MediumNetwork
MediumEnvironment Vars
MediumOversized Source Filedist/runner.mjs
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
Affected versions and remediation
This report applies to wildcrane-runner@0.6.2.
See all versions of wildcrane-runner for other recorded verdicts.
- Review the evidence and your use of wildcrane-runner@0.6.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.