wildcrane@0.11.3
WildCrane's `akb` command — scaffold the Markdown board under docs/kanban/, put an agent on a card, and carry the flows the agent works by.
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe CLI sends runtime usage telemetry by default without first disclosing it to CLI users, which warrants a warning under the telemetry rules. The inspected event contains basic metadata rather than credentials or user content, and reporting can be turned off, so this is not a publish-blocking attack.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
CLI startup, at most once per day when reporting is enabled.
Impact
Sends basic usage metadata and a pseudonymous install ID without a CLI disclosure prompt; users can turn reporting off.
Mechanism
The CLI queues an app-open event with OS, architecture, and first-run status, then POSTs queued events to t.ai4kanban.dev.
AI rationale
The CLI sends runtime usage telemetry by default without first disclosing it to CLI users, which warrants a warning under the telemetry rules. The inspected event contains basic metadata rather than credentials or user content, and reporting can be turned off, so this is not a publish-blocking attack.
Evidence
dist/kanban.mjsusage-queue.jsonlusage-state.json
Network endpoints2
t.ai4kanban.devt-dev.ai4kanban.dev
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Usage reporting defaults to on when no setting is saved.
- The CLI calls the app-open reporting path at startup; its disclosure check applies to the desktop app surface, not the command surface.
- The app-open event includes OS, architecture, and whether this is the first run, and uses a generated install ID.
- Queued events are POSTed to the package’s analytics endpoint, t.ai4kanban.dev.
- The CLI provides a telemetry-off command that disables reporting and drops queued events.
Evidence against
- The telemetry fields inspected are usage metadata; no credentials, prompts, code, or command output are included in the app-open event.
- Provider API keys are passed only for the selected provider when its settings are used.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStrings
Source & flagged code
7 flaggeddist/kanban.mjsView file
59* Constructs the CommanderError class
L60: * @param {number} exitCode suggested exit code which could be used with process.exit
L61: * @param {string} code an id string representing the error
...
L1169: var EventEmitter = __require("node:events").EventEmitter;
L1170: var childProcess = __require("node:child_process");
L1171: var path85 = __require("node:path");
...
L1219: this._outputConfiguration = {
L1220: writeOut: (str5) => process2.stdout.write(str5),
L1221: writeErr: (str5) => process2.stderr.write(str5),
...
L1258: * @returns {Command[]}
L1259: * @private
L1260: */
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/kanban.mjsView on unpkg · L591169var EventEmitter = __require("node:events").EventEmitter;
L1170: var childProcess = __require("node:child_process");
L1171: var path85 = __require("node:path");
High
2009}
L2010: const execArgv = process2.execArgv ?? [];
L2011: if (execArgv.includes("-e") || execArgv.includes("--eval") || execArgv.includes("-p") || execArgv.includes("--print")) {
High
Findings
1 Critical4 High4 Medium6 Low
CriticalCredential Exfiltrationdist/kanban.mjs
HighChild Processdist/kanban.mjs
HighShelldist/kanban.mjs
HighCommand Output Exfiltrationdist/kanban.mjs
HighKnown Malware Source Similaritydist/kanban.mjs
MediumDynamic Requirebin/ai4kanban.mjs
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowWeak Cryptodist/kanban.mjs
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to wildcrane@0.11.3.
See all versions of wildcrane for other recorded verdicts.
- Review the evidence and your use of wildcrane@0.11.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.