registry / @canonry/canonry / 7.45.0
@canonry/canonry@7.45.0
Self-hosted AI visibility (AEO) platform: track how ChatGPT, Claude, Gemini, and Perplexity cite your domain, join it with Search Console, GA4, server-side traffic, and paid media, and fix what you find through agent tools (CLI, REST, MCP). Local SQLite.
AI Security Review
scanned 18d ago · by lpm-firewall-aiThe scanner's malicious verdict is not supported by the inspected source: the manifest has no install hook, and no browser credential collection or exfiltration chain was established. Runtime auto-sync of previously installed first-party agent skills leaves a concrete, limited extension update risk, so this merits a warning.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
A normal CLI command or non-stored-only MCP startup, when saved configuration indicates a package version change or an elapsed verification interval and a previously installed skill is present.
Impact
An update can change instructions that an agent receives in a later session.
Mechanism
The package reconciles its bundled skill files into existing Claude skill folders and may provide a Codex skills link. The sync has an environment opt-out and ordinarily preserves locally changed files.
AI rationale
The scanner's malicious verdict is not supported by the inspected source: the manifest has no install hook, and no browser credential collection or exfiltration chain was established. Runtime auto-sync of previously installed first-party agent skills leaves a concrete, limited extension update risk, so this merits a warning.
Evidence
dist/cli.jsdist/mcp.jsdist/chunk-K3AEOEB7.jsdist/chunk-3T3JQB2J.jsassets/agent-workspace/skills/.claude/skills/<skill>/.codex/skills/<skill>
Decision evidence
public snapshotAI called this Suspicious at 84.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The manifest defines build and test scripts but no npm install lifecycle hook.
- Normal CLI startup and non-stored-only MCP startup call automatic skill syncing. Sync can be disabled by an environment setting and runs only when the saved configuration indicates a version change or an elapsed verification interval.
- Sync targets previously installed, package-managed skills. The installer reconciles bundled content in Claude skill folders, and its update notice says locally changed files are kept unless forced.
- The specified skill status check reads installed and missing skill directories. The plugin helper formats an update or reinstall hint, and the specified MCP configuration helper returns a path.
- The browser credential collection claim was not corroborated: the inspected browser code identifies a Chrome DevTools provider, and no browser credential scraping or transfer chain was established.
Evidence against
- The manifest has no npm install lifecycle hook.
- The automatic sync is limited to previously installed package-managed skills, and local edits are preserved by the ordinary sync path.
- Source inspection did not establish browser credential theft, unrelated credential forwarding, or an install-hook attack.
Source & flagged code
8 flaggeddist/chunk-6HUFI2G5.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @canonry/canonry@7.32.0
matchedIdentity = npm:QGNhbm9ucnkvY2Fub25yeQ:7.32.0
similarity = 0.737
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/chunk-6HUFI2G5.jsView on unpkg64677// ../integration-commoncrawl/src/plugin-installer.ts
L64678: import { spawn } from "child_process";
L64679: import fs4 from "fs/promises";
High
Child Process
Package source references child process execution.
dist/chunk-6HUFI2G5.jsView on unpkg · L64677•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/chunk-6HUFI2G5.js:
oauthAuthorizationCodes: () => oauthAuthorizationCodes,
// are untrusted correlation metadata, never authorization identities.
var oauthAuthorizationCodes = sqliteTable("oauth_authorization_codes", {
* replay, plus each attempt the provider refused for rate limit or authorization.
// Opt-in single-project scoping for API keys. NULL = full-instance access
// there is no account to infer from an API key, and inventing one would
name: "oauth-authorization-server",
// Enterprise) cannot present an API key, so this is the only way they can
Findings
3 Critical5 High3 Medium6 Low
CriticalBrowser Credential Phishingdist/chunk-3MGCNSUL.js
CriticalTrigger Reachable Dangerous Capabilitydist/chunk-3MGCNSUL.js
CriticalPrevious Version Dangerous Deltadist/chunk-6HUFI2G5.js
HighChild Processdist/chunk-6HUFI2G5.js
HighCredential Redirect Persistencedist/chunk-6HUFI2G5.js
HighCommand Output Exfiltrationdist/chunk-6HUFI2G5.js
HighCross File Remote Execution Contextdist/chunk-TH7WZBUX.js
HighSemantic Analysis Limiteddist/chunk-6HUFI2G5.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
Low
Affected versions and remediation
This report applies to @canonry/canonry@7.45.0.
See all versions of @canonry/canonry for other recorded verdicts.
- Review the evidence and your use of @canonry/canonry@7.45.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.