wildcrane@0.11.9
WildCrane's `akb` command — scaffold the Markdown board under docs/kanban/, put an agent on a card, and carry the flows the agent works by.
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe flagged credential and subprocess patterns serve the CLI’s cloud and agent features; I found no flow sending other services’ credentials to an unrelated host. Usage reporting is enabled by default for terminal users, but CLI help describes it as anonymous, links to the privacy page, and provides a command to disable it.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
CLI commands run when invoked; agent installation recipes require a user-selected command.
Impact
Observed data flows match the package’s described features; no credential theft or unrelated automatic execution was found.
Mechanism
The CLI contacts WildCrane cloud and telemetry endpoints, and forwards configured provider credentials to the selected agent or service.
AI rationale
The flagged credential and subprocess patterns serve the CLI’s cloud and agent features; I found no flow sending other services’ credentials to an unrelated host. Usage reporting is enabled by default for terminal users, but CLI help describes it as anonymous, links to the privacy page, and provides a command to disable it.
Network endpoints9
api.ai4kanban.devt.ai4kanban.devyajrbpprmdvtkvjjfpbk.supabase.coapi.openai.comapi.moonshot.aicursor.comx.aicode.kimi.comopencode.ai
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The prepare and prepublishOnly scripts only build the package.
- The CLI loads its rules and dispatches to a command when its entry point runs.
- The CLI describes its anonymous usage reporting, links to its privacy page, and provides an off command.
- The telemetry event schema limits reported fields to usage metadata such as version, platform, harness, model, and counts.
- Cloud session tokens are sent as bearer credentials to the configured WildCrane API.
Evidence against
- Usage reporting is enabled by default for terminal users, though it is disclosed in CLI help and can be turned off.
- Agent installer recipes include shell pipelines, but they are command configuration rather than automatic install hooks.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
7 flaggeddist/kanban.mjsView file
59* Constructs the CommanderError class
L60: * @param {number} exitCode suggested exit code which could be used with process.exit
L61: * @param {string} code an id string representing the error
...
L1169: var EventEmitter = __require("node:events").EventEmitter;
L1170: var childProcess = __require("node:child_process");
L1171: var path85 = __require("node:path");
...
L1219: this._outputConfiguration = {
L1220: writeOut: (str5) => process2.stdout.write(str5),
L1221: writeErr: (str5) => process2.stderr.write(str5),
...
L1258: * @returns {Command[]}
L1259: * @private
L1260: */
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/kanban.mjsView on unpkg · L591169var EventEmitter = __require("node:events").EventEmitter;
L1170: var childProcess = __require("node:child_process");
L1171: var path85 = __require("node:path");
High
2009}
L2010: const execArgv = process2.execArgv ?? [];
L2011: if (execArgv.includes("-e") || execArgv.includes("--eval") || execArgv.includes("-p") || execArgv.includes("--print")) {
High
Findings
1 Critical4 High4 Medium6 Low
CriticalCredential Exfiltrationdist/kanban.mjs
HighChild Processdist/kanban.mjs
HighShelldist/kanban.mjs
HighCommand Output Exfiltrationdist/kanban.mjs
HighKnown Malware Source Similaritydist/kanban.mjs
MediumDynamic Requirebin/ai4kanban.mjs
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowWeak Cryptodist/kanban.mjs
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to wildcrane@0.11.9.
See all versions of wildcrane for other recorded verdicts.
- Review the evidence and your use of wildcrane@0.11.9 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.