wildcrane@0.11.11
WildCrane's `akb` command — scaffold the Markdown board under docs/kanban/, put an agent on a card, and carry the flows the agent works by.
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe flagged credential and command references match provider setup and user-requested agent execution, with no credential theft identified. However, command startup sends default-on usage telemetry without the disclosure gate used for the app surface, so this warrants a warning.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
Invoking a normal CLI command when reporting is enabled by default and DO_NOT_TRACK is unset.
Impact
Usage and aggregate board activity are reported without an explicit disclosure step for CLI users; the telemetry can be disabled.
Mechanism
The CLI queues an app_open event and posts batches of runtime and aggregate usage fields to the package’s analytics endpoint.
AI rationale
The flagged credential and command references match provider setup and user-requested agent execution, with no credential theft identified. However, command startup sends default-on usage telemetry without the disclosure gate used for the app surface, so this warrants a warning.
Evidence
dist/kanban.mjs~/.ai4kanban/usage-queue.jsonl~/.ai4kanban/usage-state.json~/.ai4kanban/settings.json
Network endpoints1
t.ai4kanban.dev/v1/batch
Decision evidence
public snapshotAI called this Suspicious at 94.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- Command-surface telemetry is enabled when its setting is absent, and normal command startup queues an app_open event.
- The telemetry path gates disclosure for the app surface but not the command surface; events contain runtime details and aggregate usage counts.
- Queued telemetry is posted to the WildCrane analytics endpoint, with an environment-variable endpoint override.
- Users can disable reporting with the telemetry off command, which drops queued events and forgets the install ID.
Evidence against
- The flagged provider credentials are configured for the selected agent or provider CLI; no cross-service credential collection or exfiltration was identified.
- Cloud refresh tokens are sent to the configured WildCrane/Supabase authentication service as part of signed-in Cloud use.
- The package’s install scripts build the package; no install-time data collection was identified.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystem
Source & flagged code
7 flaggeddist/kanban.mjsView file
59* Constructs the CommanderError class
L60: * @param {number} exitCode suggested exit code which could be used with process.exit
L61: * @param {string} code an id string representing the error
...
L1169: var EventEmitter = __require("node:events").EventEmitter;
L1170: var childProcess = __require("node:child_process");
L1171: var path87 = __require("node:path");
...
L1219: this._outputConfiguration = {
L1220: writeOut: (str5) => process2.stdout.write(str5),
L1221: writeErr: (str5) => process2.stderr.write(str5),
...
L1258: * @returns {Command[]}
L1259: * @private
L1260: */
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/kanban.mjsView on unpkg · L591169var EventEmitter = __require("node:events").EventEmitter;
L1170: var childProcess = __require("node:child_process");
L1171: var path87 = __require("node:path");
High
2009}
L2010: const execArgv = process2.execArgv ?? [];
L2011: if (execArgv.includes("-e") || execArgv.includes("--eval") || execArgv.includes("-p") || execArgv.includes("--print")) {
High
Findings
1 Critical4 High4 Medium6 Low
CriticalCredential Exfiltrationdist/kanban.mjs
HighChild Processdist/kanban.mjs
HighShelldist/kanban.mjs
HighCommand Output Exfiltrationdist/kanban.mjs
HighKnown Malware Source Similaritydist/kanban.mjs
MediumDynamic Requirebin/ai4kanban.mjs
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowWeak Cryptodist/kanban.mjs
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to wildcrane@0.11.11.
See all versions of wildcrane for other recorded verdicts.
- Review the evidence and your use of wildcrane@0.11.11 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.