registry / @canonry/canonry / 7.45.1
@canonry/canonry@7.45.1
Self-hosted AI visibility (AEO) platform: track how ChatGPT, Claude, Gemini, and Perplexity cite your domain, join it with Search Console, GA4, server-side traffic, and paid media, and fix what you find through agent tools (CLI, REST, MCP). Local SQLite.
AI Security Review
scanned 18d ago · by lpm-firewall-aiThe source shows automatic updates to first-party agent skills on CLI or MCP startup, creating a residual agent extension risk. The behavior is limited to existing Canonry skill installations and does not establish malicious control-surface abuse or credential theft.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Starting the CLI or MCP server, followed by detection of a package version change.
Impact
Agent sessions may load updated package-provided instructions without a separate confirmation at update time.
Mechanism
The package finds existing Canonry skill installations and installs its bundled skills into those locations.
AI rationale
The source shows automatic updates to first-party agent skills on CLI or MCP startup, creating a residual agent extension risk. The behavior is limited to existing Canonry skill installations and does not establish malicious control-surface abuse or credential theft.
Evidence
dist/chunk-55QNMM7V.jsdist/cli.jsdist/mcp.jsdist/chunk-5A57TIOK.js~/.claude/skills
Decision evidence
public snapshotAI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The CLI starts automatic skill synchronization, and the MCP server does so unless running in stored-only mode.
- Synchronization checks for a package version change and updates only locations where Canonry skills are already installed.
- The updater installs bundled Canonry and Aero skills into agent skill directories, which can change instructions loaded by agent sessions.
- The flagged plugin location only formats an update or reinstall hint.
- The manifest declares build and maintenance scripts, with no npm install lifecycle hook.
Evidence against
- The synchronization is limited to existing installations of the package's own skills.
- The inspected plugin hint does not itself install or update a plugin.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsMinifiedPossibleObfuscation
Source & flagged code
8 flaggeddist/chunk-XFBY4DJV.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @canonry/canonry@7.32.0
matchedIdentity = npm:QGNhbm9ucnkvY2Fub25yeQ:7.32.0
similarity = 0.737
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/chunk-XFBY4DJV.jsView on unpkg64683// ../integration-commoncrawl/src/plugin-installer.ts
L64684: import { spawn } from "child_process";
L64685: import fs4 from "fs/promises";
High
Child Process
Package source references child process execution.
dist/chunk-XFBY4DJV.jsView on unpkg · L64683994gscQueryDailyTotals: () => gscQueryDailyTotals,
L995: gscSearchData: () => gscSearchData,
L996: gscUrlInspections: () => gscUrlInspections,
...
L4164: try {
L4165: return JSON.parse(value);
L4166: } catch {
...
L4698: // ga_connections
L4699: // WARNING: private_key is authentication material; consider storing in config.yaml per AGENTS.md
L4700: `CREATE TABLE IF NOT EXISTS ga_connections (
...
L12287: try {
L12288: const parsed = new URL(/^https?:\/\//i.test(trimmed) ? trimmed : `https://${trimmed}`);
L12289: return parsed.hostname.toLowerCase().replace(/\.$/, "") || null;
Findings
3 Critical5 High3 Medium6 Low
CriticalBrowser Credential Phishingdist/chunk-6333IHPS.js
CriticalTrigger Reachable Dangerous Capabilitydist/chunk-6333IHPS.js
CriticalPrevious Version Dangerous Deltadist/chunk-XFBY4DJV.js
HighChild Processdist/chunk-XFBY4DJV.js
HighCredential Redirect Persistencedist/chunk-GCBMBG2Y.js
HighCommand Output Exfiltrationdist/chunk-XFBY4DJV.js
HighCross File Remote Execution Contextdist/chunk-PIL3NHER.js
HighSemantic Analysis Limiteddist/chunk-XFBY4DJV.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
Low
Affected versions and remediation
This report applies to @canonry/canonry@7.45.1.
See all versions of @canonry/canonry for other recorded verdicts.
- Review the evidence and your use of @canonry/canonry@7.45.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.