registry / @canonry/canonry / 6.1.4
@canonry/canonry@6.1.4
Self-hosted AI visibility (AEO) platform: track how ChatGPT, Claude, Gemini, and Perplexity cite your domain, join it with Search Console, GA4, server-side traffic, and paid media, and fix what you find through agent tools (CLI, REST, MCP). Local SQLite.
AI Security Review
scanned 1mo ago · by lpm-firewall-aiSource supports a warning for first-party agent setup and automatic skill updates. The inspected behavior does not establish malicious installation hooks, credential theft, or another blocking attack.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
User runs CLI initialization, followed by later CLI commands after a version change or synchronization interval.
Impact
Package updates can change instructions loaded by coding agents without a separate update prompt.
Mechanism
Setup writes bundled skills and MCP configuration. Automatic synchronization selects installations with ownership manifests and refreshes bundled files while preserving local edits.
AI rationale
Source supports a warning for first-party agent setup and automatic skill updates. The inspected behavior does not establish malicious installation hooks, credential theft, or another blocking attack.
Evidence
dist/cli.jsdist/chunk-TBAVVIVI.jsdist/chunk-YOMLHHJS.js.claude/skills/.codex/skills/.mcp.json
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The manifest has no npm installation lifecycle hooks or runtime self-dependency.
- CLI initialization installs bundled agent skills and registers the Canonry MCP server unless skip options are supplied.
- Later CLI commands automatically synchronize skills in home or project directories that contain Canonry ownership manifests.
- Synchronization copies bundled files into Claude skills directories; locally edited files are preserved unless force is requested.
Evidence against
- Inspected network behavior includes provider authentication, configurable traffic ingestion, and package telemetry; no concrete credential theft was established.
- The flagged plugin helper formats update advice, and the flagged agent health check reads installed skill state.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsMinified
Source & flagged code
7 flaggeddist/chunk-N7MRAN3G.jsView file
946gscQueryDailyTotals: () => gscQueryDailyTotals,
L947: gscSearchData: () => gscSearchData,
L948: gscUrlInspections: () => gscUrlInspections,
...
L3916: try {
L3917: return JSON.parse(value);
L3918: } catch {
...
L4450: // ga_connections
L4451: // WARNING: private_key is authentication material; consider storing in config.yaml per AGENTS.md
L4452: `CREATE TABLE IF NOT EXISTS ga_connections (
...
L10436: };
L10437: if (projectResolver.resolve(evidence).citedCompetitorDomains.length > 0) {
L10438: projectCitationCount++;
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
dist/chunk-N7MRAN3G.jsView on unpkg · L946946Trigger-reachable chain: manifest.exports -> dist/index.js -> dist/chunk-N7MRAN3G.js
L946: gscQueryDailyTotals: () => gscQueryDailyTotals,
L947: gscSearchData: () => gscSearchData,
L948: gscUrlInspections: () => gscUrlInspections,
...
L3916: try {
L3917: return JSON.parse(value);
L3918: } catch {
...
L4450: // ga_connections
L4451: // WARNING: private_key is authentication material; consider storing in config.yaml per AGENTS.md
L4452: `CREATE TABLE IF NOT EXISTS ga_connections (
...
L10436: };
L10437: if (projectResolver.resolve(evidence).citedCompetitorDomains.length > 0) {
L10438: projectCitationCount++;
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
Findings
2 Critical5 High3 Medium6 Low
CriticalHardcoded Runtime Data Exfiltrationdist/chunk-N7MRAN3G.js
CriticalTrigger Reachable Dangerous Capabilitydist/chunk-N7MRAN3G.js
HighChild Processdist/chunk-N7MRAN3G.js
HighCredential Redirect Persistencedist/chunk-5LZLDXEN.js
HighCommand Output Exfiltrationdist/chunk-N7MRAN3G.js
HighCross File Remote Execution Contextdist/cli.js
HighSemantic Analysis Limiteddist/chunk-N7MRAN3G.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowEval
LowFilesystem
Low
Affected versions and remediation
This report applies to @canonry/canonry@6.1.4.
See all versions of @canonry/canonry for other recorded verdicts.
- Review the evidence and your use of @canonry/canonry@6.1.4 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.