registry / @canonry/canonry / 7.56.1
@canonry/canonry@7.56.1
Self-hosted AI visibility (AEO) platform: track how ChatGPT, Claude, Gemini, and Perplexity cite your domain, join it with Search Console, GA4, server-side traffic, and paid media, and fix what you find through agent tools (CLI, REST, MCP). Local SQLite.
AI Security Review
scanned 11d ago · by lpm-firewall-aiSource inspection found no lifecycle hooks or concrete malicious behavior. The high-risk matches resolve to user-invoked skill setup, configured TypeSafe classification, log-redaction logic, and explicit DuckDB or Wrangler operations.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
No automatic install trigger was found; skill setup runs through the initialization flow or an explicit skills command.
Impact
No malicious impact was established.
Mechanism
The inspected code installs bundled skills, sends a configured provider key to its named service, and runs product-specific setup or deployment processes.
AI rationale
Source inspection found no lifecycle hooks or concrete malicious behavior. The high-risk matches resolve to user-invoked skill setup, configured TypeSafe classification, log-redaction logic, and explicit DuckDB or Wrangler operations.
Decision evidence
public snapshotAI called this Clean at 87.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json lists build, typecheck, test, and lint scripts and defines CLI and library entrypoints; no npm lifecycle hook is declared.
- The skill installer writes bundled skill files and a manifest to the requested project or user directory; its callers are the explicit skills command and initialization flow.
- The runtime excerpts show tool-call limits and a usage handler restricted to successful assistant turn-end events; flagged UI, schema, and vendor paths show UI assets, declarations, and YAML parser code.
- The TypeSafe classifier sends its configured API key and request to the TypeSafe service with redirects rejected; the credential-pattern match is in log-redaction code.
- The child-process calls are tied to DuckDB plugin installation and Wrangler deployment, with the package install scoped to its plugin directory and Wrangler spawned without a shell.
- Inspected dependency snapshots identify Fastify rate-limiting/static-serving packages and the pi agent runtime, with ordinary module entrypoints.
Evidence against
Behavioral surface
ChildProcess
Source & flagged code
9 flaggeddist/traffic-T6YAKUY5.jsView file
43// src/cloudflare-worker-deploy.ts
L44: import { spawn } from "child_process";
L45: import { randomUUID } from "crypto";
High
Child Process
Package source references child process execution.
dist/traffic-T6YAKUY5.jsView on unpkg · L43dist/chunk-4J7PL5R2.jsView file
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/chunk-4J7PL5R2.js:
let sanitized = value.replace(/(authorization\s*:\s*bearer\s+)[^\s,"'}]+/gi, "$1***").replace(/((?:developer|access)[_-]?token\s*[:=]\s*["']?)[^\s,"'}]+/gi, "$1***");
Authorization: `Bearer ${this.#accessToken}`,
authorization: `Bearer ${accessToken}`,
headers: { authorization: `Bearer ${options.apiKey}`, "content-type": "application/json" },
const code = response.status === 401 || response.status === 403 ? "provider-authorization" : response.status === 413 ? "provider-context-limit" : response.status === 429 ? "provide...
const code = status === 401 || status === 403 ? "provider-authorization" : status === 413
High
Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
Findings
4 Critical5 High3 Medium5 Low
CriticalBrowser Credential Phishingdist/chunk-QAGZQ2DY.js
CriticalTrojan Source Unicodeassets/assets/vendor-yaml-Y43rmNgW.js
CriticalTrigger Reachable Dangerous Capabilitydist/chunk-QAGZQ2DY.js
CriticalPrevious Version Dangerous Deltadist/chunk-VRFTXW6H.js
HighChild Processdist/traffic-T6YAKUY5.js
HighCredential Redirect Persistencedist/chunk-4J7PL5R2.js
HighCommand Output Exfiltrationdist/chunk-VRFTXW6H.js
HighCross File Remote Execution Contextdist/chunk-JZEK26CT.js
HighSemantic Analysis Limiteddist/chunk-VRFTXW6H.js
MediumNetwork
MediumEnvironment Vars
Medium
Affected versions and remediation
This report applies to @canonry/canonry@7.56.1.
See all versions of @canonry/canonry for other recorded verdicts.
- Review the evidence and your use of @canonry/canonry@7.56.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.