wildcrane@0.11.4
WildCrane's `akb` command — scaffold the Markdown board under docs/kanban/, put an agent on a card, and carry the flows the agent works by.
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe Codex integration bypasses approvals and sandbox protections by default when launching the agent, a meaningful risk even though it is triggered by a user command. The inspected credential settings appear provider-directed, and I found no concrete evidence of exfiltration, so this warrants a warning rather than a block.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
A user runs a command that launches the Codex agent.
Impact
Codex can operate without its normal approval and sandbox restrictions, increasing the risk of unintended commands and file changes.
Mechanism
The launcher adds --dangerously-bypass-approvals-and-sandbox unless the user's arguments already specify a recognized sandbox option.
AI rationale
The Codex integration bypasses approvals and sandbox protections by default when launching the agent, a meaningful risk even though it is triggered by a user command. The inspected credential settings appear provider-directed, and I found no concrete evidence of exfiltration, so this warrants a warning rather than a block.
Evidence
dist/kanban.mjsbin/ai4kanban.mjs
Decision evidence
public snapshotAI called this Suspicious at 94.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The Codex launcher adds --dangerously-bypass-approvals-and-sandbox by default unless the user supplies a recognized sandbox flag.
- The package CLI invokes the agent runner for the user's command.
Evidence against
- The inspected API key settings tie keys to a selected provider or endpoint; I found no evidence that they are automatically sent to an unrelated collector.
- The reported curl command downloads Cursor from cursor.com/install and is configured as an agent install action, not an automatic package install hook.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
7 flaggeddist/kanban.mjsView file
59* Constructs the CommanderError class
L60: * @param {number} exitCode suggested exit code which could be used with process.exit
L61: * @param {string} code an id string representing the error
...
L1169: var EventEmitter = __require("node:events").EventEmitter;
L1170: var childProcess = __require("node:child_process");
L1171: var path86 = __require("node:path");
...
L1219: this._outputConfiguration = {
L1220: writeOut: (str5) => process2.stdout.write(str5),
L1221: writeErr: (str5) => process2.stderr.write(str5),
...
L1258: * @returns {Command[]}
L1259: * @private
L1260: */
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/kanban.mjsView on unpkg · L591169var EventEmitter = __require("node:events").EventEmitter;
L1170: var childProcess = __require("node:child_process");
L1171: var path86 = __require("node:path");
High
2009}
L2010: const execArgv = process2.execArgv ?? [];
L2011: if (execArgv.includes("-e") || execArgv.includes("--eval") || execArgv.includes("-p") || execArgv.includes("--print")) {
High
Findings
1 Critical4 High4 Medium6 Low
CriticalCredential Exfiltrationdist/kanban.mjs
HighChild Processdist/kanban.mjs
HighShelldist/kanban.mjs
HighCommand Output Exfiltrationdist/kanban.mjs
HighKnown Malware Source Similaritydist/kanban.mjs
MediumDynamic Requirebin/ai4kanban.mjs
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowWeak Cryptodist/kanban.mjs
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to wildcrane@0.11.4.
See all versions of wildcrane for other recorded verdicts.
- Review the evidence and your use of wildcrane@0.11.4 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.