@flydocs/cli@1.3.15
FlyDocs AI CLI — install, setup, and manage FlyDocs projects
AI Security Review
scanned 2mo ago · by lpm-firewall-aiNo concrete malicious install chain or exfiltration endpoint was found, but the explicit setup command can install relay-supplied agent artifacts and the CLI accesses third-party provider credentials. This warrants a warning for agent capability risk rather than a publication block.
Static reason
One or more suspicious static signals were detected.
Trigger
A user runs flydocs init, flydocs update, or a usage-related command.
Impact
A compromised or untrusted FlyDocs relay could supply project agent artifacts; local provider credentials are exposed to their intended providers during usage queries.
Mechanism
Remote artifact synchronization and provider usage-token probing.
AI rationale
No concrete malicious install chain or exfiltration endpoint was found, but the explicit setup command can install relay-supplied agent artifacts and the CLI accesses third-party provider credentials. This warrants a warning for agent capability risk rather than a publication block.
Evidence
dist/cli.js.claude/credentials.json.claude/settings.json.claude/skills/
Network endpoints3
app.flydocs.ai/api/relayapi.anthropic.com/api/oauth/usagecursor.com/api/usage
Decision evidence
public snapshotAI called this Suspicious at 89.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The user-invoked init command downloads artifacts from the FlyDocs relay and writes each returned artifact into the selected project.
- The CLI reads a Claude OAuth credential from the local credentials file or macOS keychain and sends it to Anthropic's usage endpoint.
- The CLI can read Cursor's local access token and send it as a Cursor session cookie to Cursor's usage endpoint.
Evidence against
- package.json has no preinstall, install, or postinstall lifecycle script.
- The package exposes a CLI binary; project setup is reached through explicit commands rather than package installation.
- Artifact paths are validated under the selected target directory before writes.
- Usage reporting has an opt-out and refuses collection when consent is not available.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
Source & flagged code
12 flaggeddist/cli.jsView file
•path = dist/cli.js
kind = trigger_reachable_excluded_payload
sizeBytes = 935555
triggerReachableSource = dist/cli.js
excludedPayload = template/.claude/hooks/auto-approve.py
Critical
Trigger Reachable Excluded Directory Payload
A package entrypoint or install-reachable source explicitly loads and activates an executable-looking payload from a test, fixture, or hidden path.
dist/cli.jsView on unpkg131});
L132: import { spawnSync } from "child_process";
L133: import { readFile as readFile2, realpath } from "fs/promises";
High
122SKIP_VERSION_CHECK_ENV: () => SKIP_VERSION_CHECK_ENV,
L123: buildReExecArgv: () => buildReExecArgv,
L124: closestCommand: () => closestCommand,
High
Findings
1 Critical9 High5 Medium5 Low
CriticalTrigger Reachable Excluded Directory Payloaddist/cli.js
HighChild Processdist/cli.js
HighShelldist/cli.js
HighCredential Exfiltrationdist/cli.js
HighCredential Redirect Persistencedist/cli.js
HighCommand Output Exfiltrationdist/cli.js
HighSandbox Evasion Gated Capabilitydist/cli.js
HighTrigger Reachable Credential Exfiltrationdist/cli.js
HighRuntime Package Installdist/cli.js
HighPayload In Excluded Dirtemplate/.claude/hooks/repo_context.py
MediumDynamic Requiredist/cli.js
MediumNetwork
Affected versions and remediation
This report applies to @flydocs/cli@1.3.15.
See all versions of @flydocs/cli for other recorded verdicts.
- Review the evidence and your use of @flydocs/cli@1.3.15 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.