registry / @canonry/canonry / 7.55.0
@canonry/canonry@7.55.0
Self-hosted AI visibility (AEO) platform: track how ChatGPT, Claude, Gemini, and Perplexity cite your domain, join it with Search Console, GA4, server-side traffic, and paid media, and fix what you find through agent tools (CLI, REST, MCP). Local SQLite.
AI Security Review
scanned 13d ago · by lpm-firewall-aiThe source confirms automatic updates to detected Canonry agent skills during CLI and MCP startup, leaving a residual agent-extension lifecycle risk. The credential-collection scanner match resolves to redaction logic, and no concrete malicious attack was verified.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
CLI or MCP startup when a saved configuration and a detected Canonry skill installation meet the version-change or verification-interval conditions.
Impact
An update can change instructions used by an AI agent without a separate confirmation at update time. No credential theft or other concrete attack was established.
Mechanism
The synchronizer finds Canonry skill installations in the home or current project directory and calls the installer to reconcile them with bundled skill files; an environment variable can disable syncing.
AI rationale
The source confirms automatic updates to detected Canonry agent skills during CLI and MCP startup, leaving a residual agent-extension lifecycle risk. The credential-collection scanner match resolves to redaction logic, and no concrete malicious attack was verified.
Evidence
dist/cli.jsdist/mcp.jsdist/chunk-VB47PTY7.jsdist/chunk-B37SDIGU.js.claude/skills.codex/skills
Decision evidence
public snapshotAI called this Suspicious at 79.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The CLI and MCP entrypoints call the skill synchronizer during startup; the CLI skips this only in stored-only mode. [28, 29]
- Sync checks saved version and elapsed time, can be disabled through an environment setting, and updates detected skill installations in the home or current project directories. [25, 26, 30, 31]
- The update helper writes skills under the Claude skills directory. The serving code recognizes a plugin only when its MCP command is `canonry-mcp`. [32, 33]
- The browser-credential scanner match is a credential-key redaction pattern; it does not establish credential collection. [34]
Evidence against
- The verified behavior is limited to updating Canonry’s detected skills; the source reviewed did not establish credential theft or another concrete attack.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetwork
HighEntropyStrings
Source & flagged code
8 flaggeddist/chunk-PRNO5TLE.jsView file
57101// ../integration-commoncrawl/src/plugin-installer.ts
L57102: import { spawn } from "child_process";
L57103: import fs4 from "fs/promises";
High
Child Process
Package source references child process execution.
dist/chunk-PRNO5TLE.jsView on unpkg · L57101•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/chunk-PRNO5TLE.js:
oauthAuthorizationCodes,
throw forbidden(`This action requires the "${scope}" scope on your API key.`);
var NARROW_KEY_DENIED_MESSAGE = "This API key is narrower than the install, so it cannot use an administrator surface.";
throw forbidden("Internal diagnostics require a host-approved operator API key. Customer accounts and scopes cannot grant operator access.");
throw forbidden("This API key was not granted access to OpenAI Ads paid reads.");
throw forbidden("This API key is limited to one project, and this is an instance-wide surface.");
throw forbidden("This API key was not granted access to accounts on this
High
Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
dist/chunk-PRNO5TLE.jsView on unpkgFindings
3 Critical5 High3 Medium5 Low
CriticalBrowser Credential Phishingdist/chunk-OMXWBR2R.js
CriticalTrojan Source Unicodeassets/assets/vendor-yaml-Y43rmNgW.js
CriticalTrigger Reachable Dangerous Capabilitydist/chunk-OMXWBR2R.js
HighChild Processdist/chunk-PRNO5TLE.js
HighCredential Redirect Persistencedist/chunk-PRNO5TLE.js
HighCommand Output Exfiltrationdist/chunk-PRNO5TLE.js
HighCross File Remote Execution Contextdist/chunk-2OB7YQEZ.js
HighSemantic Analysis Limiteddist/chunk-PRNO5TLE.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
Low
Affected versions and remediation
This report applies to @canonry/canonry@7.55.0.
See all versions of @canonry/canonry for other recorded verdicts.
- Review the evidence and your use of @canonry/canonry@7.55.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.