registry / @canonry/canonry / 7.58.4
@canonry/canonry@7.58.4
Self-hosted AI visibility (AEO) platform: track how ChatGPT, Claude, Gemini, and Perplexity cite your domain, join it with Search Console, GA4, server-side traffic, and paid media, and fix what you find through agent tools (CLI, REST, MCP). Local SQLite.
AI Security Review
scanned 11d ago · by lpm-firewall-aiThe source shows default runtime updates to previously installed, package-owned agent skills, so a behavior-specific warning is warranted. The reviewed code does not establish a credential-transfer attack or broad agent configuration takeover.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
An ordinary CLI invocation outside stored-only mode, or MCP startup outside stored-only scope, when the sync interval has elapsed or the package version changed.
Impact
Updated skill instructions may affect later Claude or Codex sessions, creating a residual risk from unattended first-party agent extension updates.
Mechanism
The package checks for its previously installed skills and refreshes bundled files classified as stale; edited files are retained unless force mode is enabled.
AI rationale
The source shows default runtime updates to previously installed, package-owned agent skills, so a behavior-specific warning is warranted. The reviewed code does not establish a credential-transfer attack or broad agent configuration takeover.
Evidence
package.jsondist/cli.jsdist/mcp.jsdist/chunk-4UGM5YV4.jsdist/chunk-G34BVUMF.js.claude/skills/.codex/skills/
Decision evidence
public snapshotAI called this Suspicious at 82.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The manifest exposes CLI and MCP entrypoints.
- The CLI runs skill synchronization during ordinary invocations, and MCP runs it unless configured for stored-only scope.
- Synchronization targets bundled skills already recorded in the home or current project directories.
- Synchronization is enabled by default and may run after a package version change or the default interval; an environment variable can disable it.
- Stale bundled skill files are refreshed, while edited files are preserved unless force mode is used.
Evidence against
- The sync targets are limited to previously installed package-owned skills in the home and current project directories.
- The installer classifies installed files before replacement and preserves edited files unless force mode is used.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetwork
HighEntropyStrings
Source & flagged code
8 flaggeddist/chunk-CFGA6OAK.jsView file
6331// src/commands/daemon.ts
L6332: import { spawn } from "child_process";
L6333: import fs from "fs";
High
Child Process
Package source references child process execution.
dist/chunk-CFGA6OAK.jsView on unpkg · L6331388Cross-file remote execution chain: dist/chunk-CFGA6OAK.js spawns dist/chunk-Y7NX6EIK.js; helper contains network access plus dynamic code execution.
L388: try {
L389: value = JSON.parse(readFileSync(source === "-" ? 0 : source, "utf8"));
L390: } catch {
...
L410: if (printSeoJson(value, format)) return;
L411: console.log(`SEO data: ${value.available ? "available" : "unavailable"}`);
L412: if (value.reason) console.log(value.reason);
...
L542: access: "stored",
L543: help: "Host operator only. Read private upstream receipts and cost for reconciliation.",
L544: run: (input) => showSeoOperatorTask(requirePositional(input, 0, { command: "seo.operator.task", usage: "canonry seo operator task <task-id>", message: "task ID is required" }), inp...
...
L3012: message: `Unknown --from value "${opts.
High
Cross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
dist/chunk-CFGA6OAK.jsView on unpkg · L388Findings
3 Critical5 High3 Medium5 Low
CriticalBrowser Credential Phishingdist/chunk-Y7NX6EIK.js
CriticalTrojan Source Unicodeassets/assets/vendor-yaml-Y43rmNgW.js
CriticalTrigger Reachable Dangerous Capabilitydist/chunk-Y7NX6EIK.js
HighChild Processdist/chunk-CFGA6OAK.js
HighCredential Redirect Persistencedist/chunk-6A6BD5KS.js
HighCommand Output Exfiltrationdist/chunk-NWQQYLZV.js
HighCross File Remote Execution Contextdist/chunk-CFGA6OAK.js
HighSemantic Analysis Limiteddist/chunk-NWQQYLZV.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
Low
Affected versions and remediation
This report applies to @canonry/canonry@7.58.4.
See all versions of @canonry/canonry for other recorded verdicts.
- Review the evidence and your use of @canonry/canonry@7.58.4 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.