registry / @canonry/canonry / 7.65.0
@canonry/canonry@7.65.0
Self-hosted AI visibility (AEO) platform: track how ChatGPT, Claude, Gemini, and Perplexity cite your domain, join it with Search Console, GA4, server-side traffic, and paid media, and fix what you find through agent tools (CLI, REST, MCP). Local SQLite.
AI Security Review
scanned 10d ago · by lpm-firewall-aiNo install-hook attack or unauthorized credential export was established. Automatic refresh of package-owned agent guidance on normal startup leaves a guarded agent extension lifecycle risk, so this warrants a warning without blocking publication.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Starting the CLI or non-stored-only MCP process when a Canonry skill is installed and the version or sync check qualifies.
Impact
Updated first-party guidance may change agent advice or behavior; the inspected code does not show a permission change.
Mechanism
The synchronizer finds previously installed Canonry skills in the home or current project directory and invokes the bundled skill installer to refresh their files.
AI rationale
No install-hook attack or unauthorized credential export was established. Automatic refresh of package-owned agent guidance on normal startup leaves a guarded agent extension lifecycle risk, so this warrants a warning without blocking publication.
Evidence
dist/chunk-2Y7RN5HG.jsdist/cli.jsdist/mcp.jsdist/chunk-SL3Y7IOX.jsassets/agent-workspace/skills/canonry/SKILL.md.claude/skills/canonry.claude/skills/aero
Decision evidence
public snapshotAI called this Suspicious at 84.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- CLI startup and non-stored-only MCP startup invoke the skill synchronizer; it may run after a package version change or when its check interval elapses.
- The synchronizer targets home or project directories containing manifests for Canonry's bundled skills. It refreshes those skills under `.claude/skills`; edited files are preserved unless force is requested.
- The manifest has no npm install lifecycle hook, and the runtime synchronizer has an environment opt-out.
- The separate TypeSafe transfer uses a supported evaluator endpoint. Its settings disclose the data sent, and project sentiment is disabled by default.
- The browser-password match is account schema and secret-redaction code; the YAML character is handled as a byte-order mark.
Evidence against
- No npm install-time agent configuration mutation was found.
- The automatic refresh is limited to previously installed, manifest-marked Canonry skills and preserves edited files by default.
- The TypeSafe transfer is disclosed, tied to a configured evaluator, and disabled by default.
Behavioral surface
Source & flagged code
9 flaggeddist/chunk-Z2EENWM3.jsView file
60019// ../integration-commoncrawl/src/plugin-installer.ts
L60020: import { spawn } from "child_process";
L60021: import fs4 from "fs/promises";
High
Child Process
Package source references child process execution.
dist/chunk-Z2EENWM3.jsView on unpkg · L600191190});
L1191: return `${PREFIX}${salt.toString("base64")}$${derived.toString("base64")}`;
L1192: }
...
L1497: });
L1498: app.post("/auth/login", async (request, reply) => {
L1499: const parsed = loginRequestSchema.safeParse(request.body);
...
L4958: try {
L4959: const parsed = new URL(/^https?:\/\//i.test(trimmed) ? trimmed : `https://${trimmed}`);
L4960: return parsed.hostname.toLowerCase().replace(/\.$/, "") || null;
...
L6691: if (first === 10 || first === 172 && second >= 16 && second <= 31 || first === 192 && second === 168) {
L6692: return "which is private space";
L6693: }
High
Command Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
dist/chunk-Z2EENWM3.jsView on unpkg · L1190•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 2
Findings
4 Critical5 High3 Medium5 Low
CriticalBrowser Credential Phishingdist/chunk-DQVJB6CZ.js
CriticalTrojan Source Unicodeassets/assets/vendor-yaml-Y43rmNgW.js
CriticalTrigger Reachable Dangerous Capabilitydist/chunk-DQVJB6CZ.js
CriticalPrevious Version Dangerous Deltadist/chunk-GQXSZE2Z.js
HighChild Processdist/chunk-Z2EENWM3.js
HighCredential Redirect Persistencedist/chunk-GQXSZE2Z.js
HighCommand Output Exfiltrationdist/chunk-Z2EENWM3.js
HighCross File Remote Execution Contextdist/chunk-6FN2OQKL.js
HighSemantic Analysis Limiteddist/chunk-Z2EENWM3.js
MediumNetwork
MediumEnvironment Vars
Medium
Affected versions and remediation
This report applies to @canonry/canonry@7.65.0.
See all versions of @canonry/canonry for other recorded verdicts.
- Review the evidence and your use of @canonry/canonry@7.65.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.