@flydocs/cli@1.3.13
FlyDocs AI CLI — install, setup, and manage FlyDocs projects
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is an explicit user-command agent configuration tool with credentialed network behavior and remote artifact writes. It should be warned as a dangerous capability, not blocked as malware, because no npm install hook or concrete malicious behavior was found.
Static reason
One or more suspicious static signals were detected.
Trigger
A user runs the FlyDocs initializer or update workflow, then starts an enabled Claude session.
Impact
The package can grant its own agent commands permission and place service-controlled files in the project; this is a meaningful agent-control capability but is not install-time behavior.
Mechanism
Explicit agent extension setup with credentialed relay access and remote artifact synchronization.
AI rationale
This is an explicit user-command agent configuration tool with credentialed network behavior and remote artifact writes. It should be warned as a dangerous capability, not blocked as malware, because no npm install hook or concrete malicious behavior was found.
Evidence
package.jsondist/cli.jstemplate/.claude/settings.jsontemplate/.claude/hooks/session-start.py.claude/settings.json.claude/hooks/auto-approve.py.claude/hooks/session-start.py.claude/skills.cursor/commands.cursor/rules.flydocs/credentials~/.flydocs/credentials
Network endpoints1
app.flydocs.ai/api/relay
Decision evidence
public snapshotAI called this Suspicious at 87.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The user-invoked initializer creates Claude and Cursor agent directories in the target project.
- The bundled Claude settings pre-approve FlyDocs commands and register hooks that run project-local Python.
- A session-start hook reads a FlyDocs API key and sends it as a bearer token to the FlyDocs relay.
- Cloud artifact sync writes server-provided content into the project after path validation.
Evidence against
- The manifest has no preinstall, install, or postinstall lifecycle hook; the executable is a user-run CLI.
- The credential request uses the FlyDocs relay endpoint named by the product and is limited to configured cloud projects.
- Artifact writes reject protected paths and resolve paths under the selected project root.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStrings
Source & flagged code
13 flaggeddist/cli.jsView file
•path = dist/cli.js
kind = trigger_reachable_excluded_payload
sizeBytes = 910739
triggerReachableSource = dist/cli.js
excludedPayload = template/.claude/hooks/auto-approve.py
Critical
Trigger Reachable Excluded Directory Payload
A package entrypoint or install-reachable source explicitly loads and activates an executable-looking payload from a test, fixture, or hidden path.
dist/cli.jsView on unpkg130});
L131: import { spawnSync } from "child_process";
L132: import { readFile as readFile2, realpath } from "fs/promises";
High
121SKIP_VERSION_CHECK_ENV: () => SKIP_VERSION_CHECK_ENV,
L122: buildReExecArgv: () => buildReExecArgv,
L123: closestCommand: () => closestCommand,
High
Findings
1 Critical10 High5 Medium5 Low
CriticalTrigger Reachable Excluded Directory Payloaddist/cli.js
HighChild Processdist/cli.js
HighShelldist/cli.js
HighCredential Exfiltrationdist/cli.js
HighCredential Redirect Persistencedist/cli.js
HighEntrypoint Foreign Package Code Overwritedist/cli.js
HighCommand Output Exfiltrationdist/cli.js
HighSandbox Evasion Gated Capabilitydist/cli.js
HighTrigger Reachable Credential Exfiltrationdist/cli.js
HighRuntime Package Installdist/cli.js
HighPayload In Excluded Dirtemplate/.claude/hooks/repo_context.py
MediumDynamic Require
Affected versions and remediation
This report applies to @flydocs/cli@1.3.13.
See all versions of @flydocs/cli for other recorded verdicts.
- Review the evidence and your use of @flydocs/cli@1.3.13 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.