registry / @canonry/canonry / 7.44.1
@canonry/canonry@7.44.1
Self-hosted AI visibility (AEO) platform: track how ChatGPT, Claude, Gemini, and Perplexity cite your domain, join it with Search Console, GA4, server-side traffic, and paid media, and fix what you find through agent tools (CLI, REST, MCP). Local SQLite.
AI Security Review
scanned 18d ago · by lpm-firewall-aiThe source supports a guarded, first-party agent-skill update capability, which leaves a warning-level extension lifecycle risk. The scanner's credential-theft claims were not substantiated by the inspected source.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Running the CLI, or starting MCP outside stored-only mode, when a prior Canonry skill installation exists and a version change or configured sync interval is due.
Impact
A refreshed skill can change guidance loaded in later agent sessions.
Mechanism
The package detects marked Canonry skills in home or project directories and reconciles them with the bundled skill files; an environment flag disables this behavior.
AI rationale
The source supports a guarded, first-party agent-skill update capability, which leaves a warning-level extension lifecycle risk. The scanner's credential-theft claims were not substantiated by the inspected source.
Evidence
dist/chunk-SW54HXSZ.jsdist/cli.jsdist/mcp.jsdist/chunk-5LY7EG4U.js.claude/skills.codex/skills
Decision evidence
public snapshotAI called this Suspicious at 84.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- package.json exposes CLI and JavaScript entrypoints and lists only build, typecheck, test, and lint scripts; it has no npm install lifecycle hook.
- CLI startup runs the skill sync, and MCP startup does so outside stored-only mode.
- Skill sync can be disabled with an environment flag; otherwise it runs on a version change or when the configured interval is due, and targets marked Canonry skills already present in home or project directories.
- For those targets, sync calls installSkills with the bundled skill name; installation reports conflicts and keeps local edits unless forced.
- The other agent locations inspected are a config path and explicit MCP install command, an installed-skill check, and a plugin update hint.
- The inspected browser-provider code navigates to an AI-provider conversation and reads selected page text; this does not substantiate the scanner's credential-phishing claim.
Evidence against
- The skill refresh is a runtime feature limited to previously installed Canonry skills, with an opt-out; no credential transfer or destructive action was confirmed in the inspected paths.
Behavioral surface
Source & flagged code
8 flaggeddist/chunk-57MGI2UT.jsView file
7593// src/cloudflare-worker-deploy.ts
L7594: import { spawn } from "child_process";
L7595: import { randomUUID } from "crypto";
High
Child Process
Package source references child process execution.
dist/chunk-57MGI2UT.jsView on unpkg · L7593165Cross-file remote execution chain: dist/chunk-57MGI2UT.js spawns dist/chunk-GZ2KIONF.js; helper contains network access plus dynamic code execution.
L165: URL_PATH_NORMALIZATION_VERSION,
L166: USER_PASSWORD_MIN_LENGTH,
L167: UserRoles,
...
L558: if (!/^\d+$/.test(rawPort) || !Number.isSafeInteger(port) || port < 1 || port > 65535) {
L559: throw new CliError({ code: "INVALID_PORT", message: "Demo port must be an integer between 1 and 65535.", exitCode: 1 });
L560: }
...
L606: }
L607: const url = `http://${host.includes(":") ? `[${host}]` : host}:${port}`;
L608: const result = { status: "ready", mode: "view-only", sampleData: true, url };
L609: if (isMachineFormat(options.format ?? "text")) console.log(JSON.stringify(result));
...
L1051: try {
L1052: diff = ev.diff ? JSON.parse(ev.diff) : {}
High
Cross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
dist/chunk-57MGI2UT.jsView on unpkg · L165Findings
3 Critical5 High3 Medium6 Low
CriticalBrowser Credential Phishingdist/chunk-GZ2KIONF.js
CriticalTrigger Reachable Dangerous Capabilitydist/chunk-GZ2KIONF.js
CriticalPrevious Version Dangerous Deltadist/chunk-G47XJVAS.js
HighChild Processdist/chunk-57MGI2UT.js
HighCredential Redirect Persistencedist/chunk-G47XJVAS.js
HighCommand Output Exfiltrationdist/chunk-G47XJVAS.js
HighCross File Remote Execution Contextdist/chunk-57MGI2UT.js
HighSemantic Analysis Limiteddist/chunk-G47XJVAS.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
Low
Affected versions and remediation
This report applies to @canonry/canonry@7.44.1.
See all versions of @canonry/canonry for other recorded verdicts.
- Review the evidence and your use of @canonry/canonry@7.44.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.