ai-act-report

Overall, this appears to be a legitimate compliance/reporting CLI that fetches AI-usage metrics from a fixed OpenKBS API and scans local project files to generate a JSON report. No strong indicators of malware are present (no covert exfiltration to arbitrary domains, no dynamic code execution beyond grep, and no persistence). However, two security weaknesses stand out: (1) execSync/grep uses a shell command string with PROJECT_DIR derived from environment (potential command injection if OPENKBS_PROJECT_DIR is attacker-controlled), and (2) --output is unvalidated, allowing arbitrary file overwrite within the running user’s permissions. These should be reviewed/hardened before use in untrusted environments.