Basecamp Cli — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Basecamp Cli (Plugin) and scored it 45/100 (orange). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 71 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 71 flagged
A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
basecamp is the official command-line interface for Basecamp. Manage projects, todos, messages, and more from your terminal or through AI agents.
macOS / Linux / WSL2
curl -fsSL https://basecamp.com/install-cli | bashWindows (PowerShell)
irm https://raw.githubusercontent.com/basecamp/basecamp-cli/main/scripts/install.ps1 | iexThat's it. You now have full access to Basecamp from your terminal.
<details> <summary>Other installation methods</summary>
Brew / macOS
brew install --cask basecamp/tap/basecamp-cliArch Linux / Omarchy (AUR):
yay -S basecamp-cliLinux (deb/rpm/apk):
# Download from https://github.com/basecamp/basecamp-cli/releases/latest
sudo apt install ./basecamp-cli_*_linux_amd64.deb # Debian/Ubuntu
sudo dnf install ./basecamp-cli_*_linux_amd64.rpm # Fedora/RHEL
sudo apk add --allow-untrusted ./basecamp-cli_*_linux_amd64.apk # AlpineArm64: substitute arm64 for amd64 in the filename. Verify the SHA-256 checksum from checksums.txt before installing unsigned Alpine packages.
Scoop (Windows):
scoop bucket add basecamp https://github.com/basecamp/homebrew-tap
scoop install basecamp-cliShell script (macOS / Linux / WSL2 / Git Bash):
curl -fsSL https://raw.githubusercontent.com/basecamp/basecamp-cli/main/scripts/install.sh | bashNix:
nix profile install github:basecamp/basecamp-cliGo install:
go install github.com/basecamp/basecamp-cli/cmd/basecamp@latestGitHub Release: download from Releases.
</details>
basecamp projects list # List projects
basecamp todos list --in 12345 # Todos in a project
basecamp todo "Fix bug" --in 12345 # Create todo
basecamp done 67890 # Complete todo
basecamp search "authentication" # Search across projects
basecamp files list --in 12345 # List docs & files
basecamp cards list --in 12345 # List cards (Kanban)
basecamp chat post "Hello" --in 12345 # Post to chat
basecamp comment 67890 "@Jane.Smith, done!" # Comment with @mentionbasecamp projects # Styled output in terminal, JSON when piped
basecamp projects --json # JSON with envelope and breadcrumbs
basecamp projects --quiet # Raw JSON data onlyEvery command supports --json for structured output:
{
"ok": true,
"data": [...],
"summary": "5 projects",
"breadcrumbs": [{"action": "show", "cmd": "basecamp projects show <id>"}]
}Breadcrumbs suggest next commands, making it easy for humans and agents to navigate.
OAuth 2.1 with automatic token refresh. First login opens your browser:
basecamp auth login # Authenticate with Basecamp
basecamp auth login --scope read # Read-only access (BC3 OAuth only, default)
basecamp auth login --scope full # Full read+write access (BC3 OAuth only)
basecamp auth token # Print token for scriptsUse named profiles when the same machine or agent gateway needs more than one Basecamp identity. Each profile has its own stored OAuth credentials and can be selected per command:
basecamp profile create design-agent
basecamp profile create ops-agent
basecamp --profile design-agent todo "Fix bug" --in 12345 --list 67890Set a default with basecamp profile set-default <name>, or set BASECAMP_PROFILE=<name> for a process. Actions are posted as the authenticated user for the selected profile.
To use your own OAuth app (e.g., a custom Launchpad integration):
| Variable | Purpose |
|---|---|
BASECAMP_OAUTH_CLIENT_ID | OAuth client ID |
BASECAMP_OAUTH_CLIENT_SECRET | OAuth client secret |
BASECAMP_OAUTH_REDIRECT_URI | Redirect URI (must be http:// loopback with explicit port) |
Both BASECAMP_OAUTH_CLIENT_ID and BASECAMP_OAUTH_CLIENT_SECRET must be set together.
basecamp works with any AI agent that can run shell commands.
Claude Code: basecamp setup claude — installs the plugin with skills, hooks, and agent workflow support.
Other agents: Point your agent at skills/basecamp/SKILL.md for Basecamp workflow coverage.
Agent discovery: Every command supports --help --agent for structured JSON output (flags, gotchas, subcommands). Use basecamp commands --json for the full catalog.
See install.md for step-by-step setup instructions.
~/.config/basecamp/ # Your Basecamp identity
├── credentials.json # OAuth tokens (fallback when keyring unavailable)
├── client.json # DCR client registration
└── config.json # Global preferences
~/.config/basecamp/theme/ # Tool display (optional)
└── colors.toml # TUI color scheme
~/.cache/basecamp/ # Ephemeral tool data
├── completion.json # Tab completion cache
└── resilience/ # Circuit breaker state
.basecamp/ # Per-repo (committed to git)
└── config.json # Project, account defaultsbasecamp doctor # Check CLI health and diagnose issues
basecamp doctor --verbose # Verbose output with detailsmake build # Build binary
make test # Run Go tests
make test-e2e # Run e2e tests
make lint # Run linter
make check # All checks (fmt-check, vet, lint, test, test-e2e)See CONTRIBUTING.md for development setup.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.