@datadog/ai-setup-cli@2.0.25
Interactive tool for Datadog setup
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is a powerful AI-assisted setup tool with automatic-approval modes, so it warrants a warning. Source inspection found explicit invocation and meaningful workspace and consent controls, not malicious install-time behavior.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Trigger
The user runs ai-setup-cli, including explicit headless or auto-approve modes.
Impact
The tool can alter selected project files and send selected project data to Datadog; source checks limit workspace and secret-file access.
Mechanism
AI-assisted workspace instrumentation through local and remote MCP tools.
AI rationale
This is a powerful AI-assisted setup tool with automatic-approval modes, so it warrants a warning. Source inspection found explicit invocation and meaningful workspace and consent controls, not malicious install-time behavior.
Evidence
package.jsonbin/cli.cjsdist/cli.jsdist/config.jsdist/mcp-server/localServer.jsdist/utils/workspace-boundary.jsdist/onboarding/screens/code-upload-consent-screen.js
Network endpoints2
api.${site}/api/unstable/agentic-onboardingmcp.${site}/v1/mcp?toolsets=onboarding
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The invoked CLI configures an AI coding agent with permission bypass enabled.
- Its local MCP tool can edit existing files in the selected workspace.
- The CLI enables automatic command approval for the explicit auto-approve flag and headless mode.
- The interactive flow states that source code and environment data will be uploaded to Datadog.
Evidence against
- package.json has no preinstall, install, or postinstall hook.
- The behavior starts only through the package bin command, not at install or import time.
- Interactive runs require workspace confirmation and an explicit source-upload consent screen.
- Workspace checks reject paths outside the workspace, Git metadata, and common secret files.
- The source routes agent and MCP traffic to Datadog site-derived endpoints; no unrelated exfiltration endpoint was found.
- No self-dependency, obfuscated payload, or destructive install-time behavior was found.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVars
Source & flagged code
6 flaggedbin/cli.cjsView file
15// is touched. If the version is too old we exit cleanly with a clear message.
L16: // If the version is fine we hand off to dist/cli.js via dynamic import().
L17: //
Medium
Dynamic Require
Package source references dynamic require/import behavior.
bin/cli.cjsView on unpkg · L15dist/lib/execute/execute.test.jsView file
407mkdirSync(join(dir, 'web'));
L408: writeFileSync(join(dir, 'web', 'package.json'), '{"name":"web"}\n'); // node app
L409: applyPlan(composeDatadogPlan(['apm']), dir);
...
L562: t.regex(sh, /install_script_agent7\.sh/); // recognized_install_pattern
L563: t.regex(sh, /systemctl enable/); // agent_runs_as_service
L564: t.regex(sh, /\$\{DD_API_KEY\}/); // secrets_not_inlined
...
L635: });
L636: const env = readFileSync(join(dir, '.env'), 'utf-8');
L637: t.regex(env, new RegExp(`DD_API_KEY=${REAL_KEY}`), 'real key written (sanctioned)');
Medium
Install Persistence
Source writes installer persistence such as shell profile or service configuration.
dist/lib/execute/execute.test.jsView on unpkg · L407Findings
1 High7 Medium4 Low
HighPrevious Version Dangerous Deltadist/cli.js
MediumDynamic Requirebin/cli.cjs
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/lib/execute/execute.test.js
MediumAi Review Evidencedist/config.js
MediumAi Review Evidencedist/mcp-server/localServer.js
MediumAi Review Evidencedist/cli.js
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @datadog/ai-setup-cli@2.0.25.
See all versions of @datadog/ai-setup-cli for other recorded verdicts.
- Review the evidence and your use of @datadog/ai-setup-cli@2.0.25 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.