registry / @canonry/canonry / 7.44.0
@canonry/canonry@7.44.0
Self-hosted AI visibility (AEO) platform: track how ChatGPT, Claude, Gemini, and Perplexity cite your domain, join it with Search Console, GA4, server-side traffic, and paid media, and fix what you find through agent tools (CLI, REST, MCP). Local SQLite.
AI Security Review
scanned 18d ago · by lpm-firewall-aiSource inspection found no install lifecycle hook or evidence of credential theft. Automatic updates to previously installed, package-managed agent skills remain a concrete extension lifecycle risk, so this merits a warning rather than a publish block.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Run the CLI outside stored-only mode or start MCP outside stored-only scope; synchronization proceeds when the package version changes or its verification interval expires.
Impact
Updated skill instructions may change what a connected agent loads without a new explicit install command. No credential theft or unrelated agent configuration mutation was established.
Mechanism
The updater finds existing Canonry-managed skills in the home or current directory and refreshes them from bundled package files; conflicting local edits are retained.
AI rationale
Source inspection found no install lifecycle hook or evidence of credential theft. Automatic updates to previously installed, package-managed agent skills remain a concrete extension lifecycle risk, so this merits a warning rather than a publish block.
Evidence
dist/cli.jsdist/mcp.jsdist/chunk-SW54HXSZ.jsdist/chunk-5LY7EG4U.js.claude/skills/<managed skill>.codex/skills/<managed skill>
Decision evidence
public snapshotAI called this Suspicious at 83.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The CLI starts skill synchronization on ordinary runs, and non-stored MCP startup does the same.
- Synchronization can run after a package version change or on its default daily interval; it updates only skill directories carrying Canonry's manifest.
- The package writes its bundled skills into Claude skill directories; managed Codex directories can link to those skills.
- The updater has an environment-variable opt-out, and related code checks skill installation and provides package-update guidance.
Evidence against
- package.json lists no preinstall, install, or postinstall hook.
- The updater limits targets to the home or current directory and only to skills with Canonry's manifest; the skill reconciler preserves local edits that conflict with bundled files.
- The inspected MCP configuration code identifies client config paths; it does not establish an automatic foreign configuration write.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystem
Source & flagged code
8 flaggeddist/chunk-G47XJVAS.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @canonry/canonry@7.32.0
matchedIdentity = npm:QGNhbm9ucnkvY2Fub25yeQ:7.32.0
similarity = 0.737
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/chunk-G47XJVAS.jsView on unpkg64620// ../integration-commoncrawl/src/plugin-installer.ts
L64621: import { spawn } from "child_process";
L64622: import fs4 from "fs/promises";
High
Child Process
Package source references child process execution.
dist/chunk-G47XJVAS.jsView on unpkg · L64620•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/chunk-G47XJVAS.js:
oauthAuthorizationCodes: () => oauthAuthorizationCodes,
// are untrusted correlation metadata, never authorization identities.
var oauthAuthorizationCodes = sqliteTable("oauth_authorization_codes", {
* replay, plus each attempt the provider refused for rate limit or authorization.
// Opt-in single-project scoping for API keys. NULL = full-instance access
// there is no account to infer from an API key, and inventing one would
name: "oauth-authorization-server",
// Enterprise) cannot present an API key, so this is the only way they can
Findings
3 Critical5 High3 Medium6 Low
CriticalBrowser Credential Phishingdist/chunk-GZ2KIONF.js
CriticalTrigger Reachable Dangerous Capabilitydist/chunk-GZ2KIONF.js
CriticalPrevious Version Dangerous Deltadist/chunk-G47XJVAS.js
HighChild Processdist/chunk-G47XJVAS.js
HighCredential Redirect Persistencedist/chunk-G47XJVAS.js
HighCommand Output Exfiltrationdist/chunk-G47XJVAS.js
HighCross File Remote Execution Contextdist/chunk-EJRV7RBZ.js
HighSemantic Analysis Limiteddist/chunk-G47XJVAS.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
Low
Affected versions and remediation
This report applies to @canonry/canonry@7.44.0.
See all versions of @canonry/canonry for other recorded verdicts.
- Review the evidence and your use of @canonry/canonry@7.44.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.