registry / @flydocs/cli / 1.3.2
@flydocs/cli@1.3.2
FlyDocs AI CLI — install, setup, and manage FlyDocs projects
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThis is not malicious by the stated boundary because setup is CLI-triggered rather than an npm lifecycle action and credential use is package-aligned. It warrants a warning because it deploys persistent AI-agent hooks/permissions and accesses local agent credentials.
Static reason
One or more suspicious static signals were detected.
Trigger
User runs flydocs init, or runs flydocs interactively with no command.
Impact
Project AI-agent configuration and hooks are installed; a Claude OAuth token may be used to query plan status from Anthropic.
Mechanism
First-party agent-extension setup with lifecycle hooks and consent-gated usage collection.
AI rationale
This is not malicious by the stated boundary because setup is CLI-triggered rather than an npm lifecycle action and credential use is package-aligned. It warrants a warning because it deploys persistent AI-agent hooks/permissions and accesses local agent credentials.
Evidence
package.jsondist/cli.jstemplate/manifest.jsontemplate/.claude/settings.json.claude/settings.json.claude/hooks.claude/skills/flydocs-workflow.cursor/hooks.json~/.claude/.credentials.json~/.flydocs/plan-status-cache.json
Network endpoints2
api.anthropic.com/api/oauth/usageapp.flydocs.ai/api/relay
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- Interactive CLI invocation without a command defaults to init.
- The shipped template owns and overwrites Claude settings and hook directories.
- Template enables a FlyDocs MCP server and command hooks, including a Stop usage-capture hook.
- Usage code reads Claude OAuth credentials and calls Anthropic's usage endpoint only when plan status is allowed.
Evidence against
- package.json has no preinstall, install, or postinstall lifecycle hook.
- The package is activated through its flydocs bin, not on npm installation.
- Credential use targets the official Anthropic API; no source evidence shows token forwarding to FlyDocs or another host.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
13 flaggeddist/cli.jsView file
•path = dist/cli.js
kind = trigger_reachable_excluded_payload
sizeBytes = 772067
triggerReachableSource = dist/cli.js
excludedPayload = template/.claude/hooks/auto-approve.py
Critical
Trigger Reachable Excluded Directory Payload
A package entrypoint or install-reachable source explicitly loads and activates an executable-looking payload from a test, fixture, or hidden path.
dist/cli.jsView on unpkg123});
L124: import { spawnSync } from "child_process";
L125: import { readFile as readFile2, realpath } from "fs/promises";
High
114SKIP_VERSION_CHECK_ENV: () => SKIP_VERSION_CHECK_ENV,
L115: buildReExecArgv: () => buildReExecArgv,
L116: closestCommand: () => closestCommand,
High
114
Findings
1 Critical10 High5 Medium5 Low
CriticalTrigger Reachable Excluded Directory Payloaddist/cli.js
HighChild Processdist/cli.js
HighShelldist/cli.js
HighCredential Exfiltrationdist/cli.js
HighCredential Redirect Persistencedist/cli.js
HighEntrypoint Foreign Package Code Overwritedist/cli.js
HighCommand Output Exfiltrationdist/cli.js
HighSandbox Evasion Gated Capabilitydist/cli.js
HighTrigger Reachable Credential Exfiltrationdist/cli.js
HighRuntime Package Installdist/cli.js
HighPayload In Excluded Dirtemplate/.claude/hooks/repo_context.py
MediumDynamic Require
Affected versions and remediation
This report applies to @flydocs/cli@1.3.2.
See all versions of @flydocs/cli for other recorded verdicts.
- Review the evidence and your use of @flydocs/cli@1.3.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.