registry / @canonry/canonry / 7.32.0
@canonry/canonry@7.32.0
Self-hosted AI visibility (AEO) platform: track how ChatGPT, Claude, Gemini, and Perplexity cite your domain, join it with Search Console, GA4, server-side traffic, and paid media, and fix what you find through agent tools (CLI, REST, MCP). Local SQLite.
AI Security Review
scanned 24d ago · by lpm-firewall-aiThe source shows automatic refresh of existing Canonry-managed agent skills, a guarded lifecycle capability that warrants a warning. The inspected evidence does not establish credential theft, unconsented broad agent-control mutation, or another block-eligible attack.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Running the CLI when a saved package-version change or sync interval makes automatic skill sync eligible.
Impact
A later CLI run may update agent skill instructions without a fresh prompt, potentially changing behavior available to the configured agent.
Mechanism
The sync detects existing skill directories with Canonry manifests and invokes the bundled skill installer; locally edited files are preserved unless force is used.
AI rationale
The source shows automatic refresh of existing Canonry-managed agent skills, a guarded lifecycle capability that warrants a warning. The inspected evidence does not establish credential theft, unconsented broad agent-control mutation, or another block-eligible attack.
Evidence
dist/chunk-FW4GX2LO.jsdist/chunk-QFXD7GR5.js.claude/skills
Decision evidence
public snapshotAI called this Suspicious at 84.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- On CLI startup, automatic skill sync can update existing Canonry-managed Claude skills when the package version changes or its verification interval elapses.
- The sync targets skills carrying Canonry’s manifest and installs into `.claude/skills`; edited files are preserved unless force is used.
- The manifest exposes CLI commands and has no preinstall, install, or postinstall hook.
Evidence against
- The inspected TypeSafe request sends a supplied API key to the fixed TypeSafe endpoint with redirects disabled; this is consistent with the named integration.
- MCP client configuration targets supported client config paths, and the inspected excerpts do not show an unrelated credential recipient or broad control-surface mutation.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsMinifiedPossibleObfuscation
Source & flagged code
9 flaggeddist/chunk-WRHA54BN.jsView file
945gscQueryDailyTotals: () => gscQueryDailyTotals,
L946: gscSearchData: () => gscSearchData,
L947: gscUrlInspections: () => gscUrlInspections,
...
L4093: try {
L4094: return JSON.parse(value);
L4095: } catch {
...
L4627: // ga_connections
L4628: // WARNING: private_key is authentication material; consider storing in config.yaml per AGENTS.md
L4629: `CREATE TABLE IF NOT EXISTS ga_connections (
...
L11957: try {
L11958: const parsed = new URL(/^https?:\/\//i.test(trimmed) ? trimmed : `https://${trimmed}`);
L11959: return parsed.hostname.toLowerCase().replace(/\.$/, "") || null;
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
dist/chunk-WRHA54BN.jsView on unpkg · L94563303// ../integration-commoncrawl/src/plugin-installer.ts
L63304: import { spawn } from "child_process";
L63305: import fs4 from "fs/promises";
High
Child Process
Package source references child process execution.
dist/chunk-WRHA54BN.jsView on unpkg · L63303945gscQueryDailyTotals: () => gscQueryDailyTotals,
L946: gscSearchData: () => gscSearchData,
L947: gscUrlInspections: () => gscUrlInspections,
...
L4093: try {
L4094: return JSON.parse(value);
L4095: } catch {
...
L4627: // ga_connections
L4628: // WARNING: private_key is authentication material; consider storing in config.yaml per AGENTS.md
L4629: `CREATE TABLE IF NOT EXISTS ga_connections (
...
L11957: try {
L11958: const parsed = new URL(/^https?:\/\//i.test(trimmed) ? trimmed : `https://${trimmed}`);
L11959: return parsed.hostname.toLowerCase().replace(/\.$/, "") || null;
Findings
4 Critical5 High3 Medium6 Low
CriticalHardcoded Runtime Data Exfiltrationdist/chunk-WRHA54BN.js
CriticalBrowser Credential Phishingdist/chunk-42XUY243.js
CriticalTrigger Reachable Dangerous Capabilitydist/chunk-42XUY243.js
CriticalPrevious Version Dangerous Deltadist/cli.js
HighChild Processdist/chunk-WRHA54BN.js
HighCredential Redirect Persistencedist/chunk-K5EGSSXC.js
HighCommand Output Exfiltrationdist/chunk-WRHA54BN.js
HighCross File Remote Execution Contextdist/cli.js
HighSemantic Analysis Limiteddist/chunk-WRHA54BN.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
Affected versions and remediation
This report applies to @canonry/canonry@7.32.0.
See all versions of @canonry/canonry for other recorded verdicts.
- Review the evidence and your use of @canonry/canonry@7.32.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.