registry / @canonry/canonry / 5.34.0
@canonry/canonry@5.34.0
Self-hosted AI visibility (AEO) platform: track how ChatGPT, Claude, Gemini, and Perplexity cite your domain, join it with Search Console, GA4, server-side traffic, and paid media, and fix what you find through agent tools (CLI, REST, MCP). Local SQLite.
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe inspected source supports a guarded first-party agent extension lifecycle warning because later executions automatically update installed agent instructions. No npm install hook or concrete malicious behavior supports blocking publication.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
User-invoked setup or skills installation, followed by CLI or MCP execution after a version change or synchronization interval.
Impact
Previously installed agent instructions can change automatically as package assets change; local edits are preserved by default.
Mechanism
Existing bundled-skill manifests authorize synchronization in the home or current project directory; stale bundled files are copied without a new prompt.
AI rationale
The inspected source supports a guarded first-party agent extension lifecycle warning because later executions automatically update installed agent instructions. No npm install hook or concrete malicious behavior supports blocking publication.
Evidence
dist/cli.jsdist/mcp.jsdist/chunk-VHPGBX4P.jsdist/chunk-QTETJEHI.js.claude/skills/canonry.claude/skills/aero.codex/skills/canonry.codex/skills/aero
Decision evidence
public snapshotAI called this Suspicious at 94.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- User-invoked initialization installs bundled agent skills unless skipSkills is set.
- Later CLI and MCP runs automatically synchronize previously installed skills.
- Synchronization targets only bundled skills with an existing installation manifest.
- Synchronization replaces stale bundled files but preserves local edits unless forced.
- Automatic synchronization can be disabled through CANONRY_NO_AUTO_SKILLS_SYNC.
- package.json has no npm installation lifecycle hook or runtime self-dependency.
Evidence against
- No concrete malicious attack was established in the inspected integration paths.
- The flagged plugin setup location only formats update advice; the flagged health check reads skill installation status.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsMinifiedPossibleObfuscation
Source & flagged code
8 flaggeddist/chunk-G2K5KCUY.jsView file
946gscQueryDailyTotals: () => gscQueryDailyTotals,
L947: gscSearchData: () => gscSearchData,
L948: gscUrlInspections: () => gscUrlInspections,
...
L3916: try {
L3917: return JSON.parse(value);
L3918: } catch {
...
L4450: // ga_connections
L4451: // WARNING: private_key is authentication material; consider storing in config.yaml per AGENTS.md
L4452: `CREATE TABLE IF NOT EXISTS ga_connections (
...
L10436: };
L10437: if (projectResolver.resolve(evidence).citedCompetitorDomains.length > 0) {
L10438: projectCitationCount++;
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
dist/chunk-G2K5KCUY.jsView on unpkg · L946946Trigger-reachable chain: manifest.exports -> dist/index.js -> dist/chunk-G2K5KCUY.js
L946: gscQueryDailyTotals: () => gscQueryDailyTotals,
L947: gscSearchData: () => gscSearchData,
L948: gscUrlInspections: () => gscUrlInspections,
...
L3916: try {
L3917: return JSON.parse(value);
L3918: } catch {
...
L4450: // ga_connections
L4451: // WARNING: private_key is authentication material; consider storing in config.yaml per AGENTS.md
L4452: `CREATE TABLE IF NOT EXISTS ga_connections (
...
L10436: };
L10437: if (projectResolver.resolve(evidence).citedCompetitorDomains.length > 0) {
L10438: projectCitationCount++;
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
Findings
3 Critical5 High3 Medium6 Low
CriticalHardcoded Runtime Data Exfiltrationdist/chunk-G2K5KCUY.js
CriticalTrigger Reachable Dangerous Capabilitydist/chunk-G2K5KCUY.js
CriticalPrevious Version Dangerous Deltadist/cli.js
HighChild Processdist/chunk-G2K5KCUY.js
HighCredential Redirect Persistencedist/chunk-AIAVZY6L.js
HighCommand Output Exfiltrationdist/chunk-G2K5KCUY.js
HighCross File Remote Execution Contextdist/cli.js
HighSemantic Analysis Limiteddist/chunk-G2K5KCUY.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowEval
Affected versions and remediation
This report applies to @canonry/canonry@5.34.0.
See all versions of @canonry/canonry for other recorded verdicts.
- Review the evidence and your use of @canonry/canonry@5.34.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.