registry / @canonry/canonry / 7.63.1
@canonry/canonry@7.63.1
Self-hosted AI visibility (AEO) platform: track how ChatGPT, Claude, Gemini, and Perplexity cite your domain, join it with Search Console, GA4, server-side traffic, and paid media, and fix what you find through agent tools (CLI, REST, MCP). Local SQLite.
AI Security Review
scanned 11d ago · by lpm-firewall-aiThe automatic refresh of package-owned agent skills leaves a residual agent instruction update risk, so this warrants a warning. The inspected source does not establish credential theft, malicious payload execution, or an npm install-time attack.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A regular CLI or non-stored MCP startup runs the updater after a package version change or the configured verification interval, when an owned skill manifest exists.
Impact
Later coding-agent sessions may load changed first-party instructions. Locally edited files are preserved unless the force option is used.
Mechanism
The updater copies bundled Canonry skills into Claude skill directories and maintains Codex symlinks. First-run setup can also install skills into a project directory.
AI rationale
The automatic refresh of package-owned agent skills leaves a residual agent instruction update risk, so this warrants a warning. The inspected source does not establish credential theft, malicious payload execution, or an npm install-time attack.
Evidence
dist/chunk-SQYYAYH6.jsdist/cli.jsdist/mcp.jsdist/init-TU4VSGVU.jsdist/chunk-PH7RTAWW.jsdist/chunk-32KNDPD3.jsassets/agent-workspace/skills/canonry/SKILL.mdassets/agent-workspace/skills/aero/SKILL.md.claude/skills/canonry/.claude/skills/aero/.codex/skills/canonry.codex/skills/aero
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The package exposes CLI, MCP, and library entry points; its manifest scripts are build, typecheck, test, and lint tasks, with no npm install hook.
- First-run setup installs bundled skills into a project directory unless skipped; a separate command also lets users install selected skills explicitly.
- Regular CLI and MCP startup call the skill updater. It checks for a package version change or a daily interval, then targets only bundled skills with an existing ownership manifest in the home or current directory.
- The updater changes first-party Claude skill files and Codex links. It preserves locally edited files unless forced, and the inspected bundled skills contain product operation guidance.
- The TypeSafe classifier uses its own TypeSafe key and sends it to the named TypeSafe classifier endpoint; I found no evidence that it forwards another provider's credentials to an unrelated recipient.
Evidence against
- No preinstall, install, or postinstall hook activates the skill setup during npm installation.
- The updater is limited to package-owned skill locations and preserves local edits by default; the reviewed skill text describes Canonry workflows.
Source & flagged code
8 flaggeddist/chunk-22ABGRB7.jsView file
59850// ../integration-commoncrawl/src/plugin-installer.ts
L59851: import { spawn } from "child_process";
L59852: import fs4 from "fs/promises";
High
Child Process
Package source references child process execution.
dist/chunk-22ABGRB7.jsView on unpkg · L59850•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/chunk-22ABGRB7.js:
oauthAuthorizationCodes,
throw forbidden(`This action requires the "${scope}" scope on your API key.`);
var NARROW_KEY_DENIED_MESSAGE = "This API key is narrower than the install, so it cannot use an administrator surface.";
throw forbidden("Internal diagnostics require a host-approved operator API key. Customer accounts and scopes cannot grant operator access.");
function requirePaidReadScope(request, allowedScopes = [ADS_WRITE_SCOPE, ADS_APPROVE_SCOPE, ADS_ACTIVATE_SCOPE], denialMessage = "This API key was not granted access to OpenAI Ads ...
throw forbidden("This API key is limited to one project, and this is
High
Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
dist/chunk-22ABGRB7.jsView on unpkgFindings
3 Critical5 High3 Medium5 Low
CriticalBrowser Credential Phishingdist/chunk-TKLE2Y6H.js
CriticalTrojan Source Unicodeassets/assets/vendor-yaml-Y43rmNgW.js
CriticalTrigger Reachable Dangerous Capabilitydist/chunk-TKLE2Y6H.js
HighChild Processdist/chunk-22ABGRB7.js
HighCredential Redirect Persistencedist/chunk-22ABGRB7.js
HighCommand Output Exfiltrationdist/chunk-22ABGRB7.js
HighCross File Remote Execution Contextdist/chunk-32KNDPD3.js
HighSemantic Analysis Limiteddist/chunk-22ABGRB7.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
Low
Affected versions and remediation
This report applies to @canonry/canonry@7.63.1.
See all versions of @canonry/canonry for other recorded verdicts.
- Review the evidence and your use of @canonry/canonry@7.63.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.