registry / @canonry/canonry / 7.11.0
@canonry/canonry@7.11.0
Self-hosted AI visibility (AEO) platform: track how ChatGPT, Claude, Gemini, and Perplexity cite your domain, join it with Search Console, GA4, server-side traffic, and paid media, and fix what you find through agent tools (CLI, REST, MCP). Local SQLite.
AI Security Review
scanned 22d ago · by lpm-firewall-aiThe package has no npm install hook, but its CLI can automatically update previously installed Canonry skills, creating a real agent-extension lifecycle risk. The source does not substantiate the scanner's broader malicious claims.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
A user runs a CLI command and the stored version or sync interval check permits an update.
Impact
Updated skill instructions may affect later agent behavior. The inspected flow does not establish broad foreign configuration changes or data transfer.
Mechanism
The sync finds Canonry-manifest skills in the home or project directory and copies updated bundled skill files into their Claude skill directories.
AI rationale
The package has no npm install hook, but its CLI can automatically update previously installed Canonry skills, creating a real agent-extension lifecycle risk. The source does not substantiate the scanner's broader malicious claims.
Evidence
dist/cli.jsdist/chunk-JRBQFRNT.jsdist/chunk-GQAESNJT.js.claude/skills/<name>
Decision evidence
public snapshotAI called this Suspicious at 84.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The supplied agent locations cover bundled skill paths, skill checks, a Canonry plugin update hint, and MCP configuration helpers; the MCP configuration command is explicitly invoked through the CLI.
- The package has CLI entry points but no npm install lifecycle hook.
- Running the CLI starts a background skill sync. It checks stored version and timing state and can be disabled with an environment setting.
- The sync searches home and project directories only for skills bearing Canonry's manifest, then invokes the package's skill installer for those targets.
- The installer writes bundled skills under Claude's skill directory, refreshes package-owned stale files, and preserves locally edited files unless forced.
Evidence against
- The agent update requires a CLI invocation and an existing Canonry-marked skill; it does not run as an npm install hook.
- The inspected source does not establish credential theft, broad foreign agent configuration mutation, or another concrete attack chain.
Behavioral surface
ChildProcess
Source & flagged code
9 flaggeddist/chunk-HA2BAJ6Z.jsView file
898gscQueryDailyTotals: () => gscQueryDailyTotals,
L899: gscSearchData: () => gscSearchData,
L900: gscUrlInspections: () => gscUrlInspections,
...
L3933: try {
L3934: return JSON.parse(value);
L3935: } catch {
...
L4467: // ga_connections
L4468: // WARNING: private_key is authentication material; consider storing in config.yaml per AGENTS.md
L4469: `CREATE TABLE IF NOT EXISTS ga_connections (
...
L11670: try {
L11671: const parsed = new URL(/^https?:\/\//i.test(trimmed) ? trimmed : `https://${trimmed}`);
L11672: return parsed.hostname.toLowerCase().replace(/\.$/, "") || null;
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
dist/chunk-HA2BAJ6Z.jsView on unpkg · L89861256// ../integration-commoncrawl/src/plugin-installer.ts
L61257: import { spawn } from "child_process";
L61258: import fs4 from "fs/promises";
High
Child Process
Package source references child process execution.
dist/chunk-HA2BAJ6Z.jsView on unpkg · L61256•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/chunk-HA2BAJ6Z.js:
oauthAuthorizationCodes: () => oauthAuthorizationCodes,
// are untrusted correlation metadata, never authorization identities.
var oauthAuthorizationCodes = sqliteTable("oauth_authorization_codes", {
* replay, plus each attempt the provider refused for rate limit or authorization.
// Opt-in single-project scoping for API keys. NULL = full-instance access
// there is no account to infer from an API key, and inventing one would
name: "oauth-authorization-server",
// Enterprise) cannot present an API key, so this is the only way they can
Findings
4 Critical5 High3 Medium6 Low
CriticalHardcoded Runtime Data Exfiltrationdist/chunk-HA2BAJ6Z.js
CriticalBrowser Credential Phishingdist/chunk-CF7G2HGX.js
CriticalTrigger Reachable Dangerous Capabilitydist/chunk-CF7G2HGX.js
CriticalPrevious Version Dangerous Deltadist/cli.js
HighChild Processdist/chunk-HA2BAJ6Z.js
HighCredential Redirect Persistencedist/chunk-HA2BAJ6Z.js
HighCommand Output Exfiltrationdist/chunk-HA2BAJ6Z.js
HighCross File Remote Execution Contextdist/cli.js
HighSemantic Analysis Limiteddist/chunk-HA2BAJ6Z.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
Affected versions and remediation
This report applies to @canonry/canonry@7.11.0.
See all versions of @canonry/canonry for other recorded verdicts.
- Review the evidence and your use of @canonry/canonry@7.11.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.