registry / @crbonfree/cli / 0.2.0
@crbonfree/cli@0.2.0
See the carbon footprint of your AI coding agents, and give them a shared memory across every tool.
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe reviewed network flows match usage syncing to the configured Crbon backend and proxying to the official provider APIs. Hook configuration changes are performed by the hook installer, and the manifest declares no install lifecycle script.
Static reason
One or more suspicious static signals were detected.
Trigger
User-invoked CLI commands, including sync, proxy, and hook installation.
Impact
These actions support the package’s stated features. The inspected paths show no unauthorized credential forwarding or hidden install-time behavior.
Mechanism
Sync sends usage records and the configured API key to the configured backend; the proxy forwards provider traffic to configured upstreams; the installer adds Crbon hooks to agent settings.
AI rationale
The reviewed network flows match usage syncing to the configured Crbon backend and proxying to the official provider APIs. Hook configuration changes are performed by the hook installer, and the manifest declares no install lifecycle script.
Evidence
~/.crbon/config.json.claude/settings.json.gemini/settings.json.codex/hooks.json.cursor/hooks.json
Network endpoints3
api.crbonfree.comapi.anthropic.comapi.openai.com
Decision evidence
public snapshotAI called this Clean at 88.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package exposes user-invoked CLI commands; its main entry parses arguments and dispatches commands.
- Sign-in uses the configured backend URL, defaults to the Crbon service, and describes prompting for an API key with hidden input.
- Usage records are posted with the API key to the URL supplied by the sync flow.
- The proxy’s default upstreams are the official Anthropic and OpenAI API hosts.
- The hook installer merges Crbon hooks into agent settings when its installer function runs.
Evidence against
- No install, preinstall, or postinstall lifecycle script is declared in the manifest.
- The inspected credential flow sends the key to the configured backend, and hook installation is exposed as an explicit command.
- The proxy routes requests to the provider APIs named in its default upstream configuration.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
Source & flagged code
11 flaggeddist/updateBin.jsView file
437// src/openBrowser.ts
L438: import { execFile } from "child_process";
L439: import { readFileSync as readFileSync6 } from "fs";
High
Child Process
Package source references child process execution.
dist/updateBin.jsView on unpkg · L437668const modPath = "./openclawPlugin.js";
L669: const mod = await import(modPath);
L670: if (typeof mod.installOpenClawPlugin === "function") {
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/updateBin.jsView on unpkg · L668dist/mechanisms/compressCliBin.jsView file
495const result = spawnSync(command, {
L496: shell: true,
L497: encoding: "utf-8",
High
Shell
Package source references shell execution.
dist/mechanisms/compressCliBin.jsFindings
8 High5 Medium5 Low
HighChild Processdist/updateBin.js
HighShelldist/mechanisms/compressCliBin.js
HighSame File Env Network Executiondist/proxyServerBin.js
HighCredential Redirect Persistencedist/cli.js
HighSandbox Evasion Gated Capabilitydist/proxyServerBin.js
HighExternal Ai Agent Control Surface Mutationdist/cli.js
HighTrigger Reachable Persistencedist/cli.js
HighSemantic Analysis Limiteddist/hooks/installerBin.js#virtual:normalized:round1
MediumDynamic Requiredist/updateBin.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/cli.js
Affected versions and remediation
This report applies to @crbonfree/cli@0.2.0.
See all versions of @crbonfree/cli for other recorded verdicts.
- Review the evidence and your use of @crbonfree/cli@0.2.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.