registry / @canonry/canonry / 7.64.3
@canonry/canonry@7.64.3
Self-hosted AI visibility (AEO) platform: track how ChatGPT, Claude, Gemini, and Perplexity cite your domain, join it with Search Console, GA4, server-side traffic, and paid media, and fix what you find through agent tools (CLI, REST, MCP). Local SQLite.
AI Security Review
scanned 10d ago · by lpm-firewall-aiThe package has a bounded first-party skill update path that can silently change agent instructions after the user has installed them. This supports a warning for agent extension lifecycle risk, but the inspected behavior does not establish a concrete attack warranting a publish block.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Launch the CLI or start MCP outside stored-only mode when a skill refresh is due.
Impact
Updated skill instructions could affect agent behavior. The inspected source does not establish credential theft, unrelated configuration changes, or data transfer.
Mechanism
The updater looks for existing Canonry skill manifests in the home or current project directory and reconciles those skill files with the bundled copy. Locally edited files are preserved as conflicts unless forced.
AI rationale
The package has a bounded first-party skill update path that can silently change agent instructions after the user has installed them. This supports a warning for agent extension lifecycle risk, but the inspected behavior does not establish a concrete attack warranting a publish block.
Evidence
dist/cli.jsdist/mcp.jsdist/chunk-MFNU4NRS.jsdist/chunk-G33PG23U.jsdist/chunk-MLXU4QOF.jsassets/agent-workspace/skills/canonry/SKILL.md.claude/skills/<skill>/.codex/skills/<skill>/
Decision evidence
public snapshotAI called this Suspicious at 83.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The manifest lists build and development scripts but no install lifecycle hook; synchronization runs from CLI or MCP startup.
- CLI startup invokes skill synchronization, and MCP startup does so unless it is in stored-only mode.
- Synchronization can be disabled and targets only home or project directories with an existing Canonry skill manifest.
- Stale bundled skill files can be copied over; locally edited files are kept as conflicts unless forced.
- The package exposes an explicit skills-install command, and its installed skill is an optional operations guide.
Evidence against
- The update is limited to previously installed, package-owned skills; the inspected source does not show changes to unrelated agent settings or data transfer.
- The package manifest has no preinstall, install, or postinstall hook.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetwork
Source & flagged code
9 flaggeddist/google-5BZYXAJH.jsView file
89try {
L90: const { spawn } = await import("child_process");
L91: const platform = process.platform;
High
Child Process
Package source references child process execution.
dist/google-5BZYXAJH.jsView on unpkg · L89dist/chunk-HQGMIHG6.jsView file
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/chunk-HQGMIHG6.js:
let sanitized = value.replace(/(authorization\s*:\s*bearer\s+)[^\s,"'}]+/gi, "$1***").replace(/((?:developer|access)[_-]?token\s*[:=]\s*["']?)[^\s,"'}]+/gi, "$1***");
Authorization: `Bearer ${this.#accessToken}`,
authorization: `Bearer ${accessToken}`,
Authorization: `Basic ${Buffer.from(`${credentials.login}:${credentials.password}`).toString("base64")}`,
headers: { authorization: `Bearer ${options.apiKey}`, "content-type": "application/json" },
const code = response.status === 401 || response.status === 403 ? "provider-authorization" : response.status === 413 ? "provider-context-limit" : response.status === 42
High
Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
Findings
4 Critical5 High3 Medium5 Low
CriticalBrowser Credential Phishingdist/chunk-YVYID65D.js
CriticalTrojan Source Unicodeassets/assets/vendor-yaml-Y43rmNgW.js
CriticalTrigger Reachable Dangerous Capabilitydist/chunk-YVYID65D.js
CriticalPrevious Version Dangerous Deltadist/chunk-UX667IQM.js
HighChild Processdist/google-5BZYXAJH.js
HighCredential Redirect Persistencedist/chunk-HQGMIHG6.js
HighCommand Output Exfiltrationdist/chunk-UX667IQM.js
HighCross File Remote Execution Contextdist/chunk-MLXU4QOF.js
HighSemantic Analysis Limiteddist/chunk-UX667IQM.js
MediumNetwork
MediumEnvironment Vars
Medium
Affected versions and remediation
This report applies to @canonry/canonry@7.64.3.
See all versions of @canonry/canonry for other recorded verdicts.
- Review the evidence and your use of @canonry/canonry@7.64.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.