Kombai - Your AI design engineer
Ship standout websites and product frontends. Bring design craft and production code together. Works with VS Code, Cursor, Devin Desktop, Claude Code, Codex etc.
Security Findings
21Dynamic exec of remote content (VSX)
SuspiciousScannerDownload-and-execute in extension-main.js: irm https://claude.ai/install.ps1 | iex
extension-main.js
Dynamic exec of remote content (VSX)
SuspiciousScannerFetched content reaches a dynamic exec sink in design-mode-server/index.cjs: fetch(
design-mode-server/index.cjs
Dynamic exec of remote content (VSX)
SuspiciousScannerFetched content reaches a dynamic exec sink in design-mode-server/worker.cjs: fetch(
design-mode-server/worker.cjs
Dynamic exec of remote content (VSX)
SuspiciousScannerFetched content reaches a dynamic exec sink in design-mode-server/test-server.cjs: fetch(
design-mode-server/test-server.cjs
Dynamic exec of remote content (VSX)
SuspiciousScannerFetched content reaches a dynamic exec sink in bundle.js: fetch(
bundle.js
Dynamic exec of remote content (VSX)
SuspiciousScannerFetched content reaches a dynamic exec sink in design-mode-server/dev.cjs: fetch(
design-mode-server/dev.cjs
Hardcoded secrets/API keys6×
SuspiciousScannerSecret Keyword: AIzaS...****
Secret Keyword: use s...****
Secret Keyword: ****
Secret Keyword: deskt...****
Secret Keyword: phc_i...****
Secret Keyword: excal...****
bundle.js
Hardcoded secrets/API keys
SuspiciousScannerSecret Keyword: https...****
vendor/claude-agent-sdk/sdk.mjs
Hardcoded secrets/API keys
SuspiciousScannerSecret Keyword: deskt...****
browser-server/903.worker.cjs
Hardcoded secrets/API keys
SuspiciousScannerSecret Keyword: ****
vendor/claude-agent-sdk/sdk.d.ts
Sensitive file access3×
SuspiciousScannerAccess to sensitive file: ~/.ssh
Access to sensitive file: homedir(),S.slice(1)):S}function Q(S){p("Loading env from encrypted .env.vault");let x=E._parseVault(S),k=process.env;re...
Access to sensitive file: homedir(),"Downloads"),S=K.existsSync(v)?v:Ae.homedir(),E=await w.window.showSaveDialog({defaultUri:w.Uri.file(k.join(S,...
Dangerous security bypass flags2×
SuspiciousScannerBypass flag in content: --trust
Bypass flag in command: `+(0,hTe.wrapInASCIIBox)(fTe.kNoXServerRunningError,1)),e}amendEnvironment(e){if(!Cer.default.isAbsolute(XK.default.home...