registry / @flydocs/cli / 1.3.24
@flydocs/cli@1.3.24
FlyDocs AI CLI — install, setup, and manage FlyDocs projects
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThis is first-party agent-extension setup performed by an explicit CLI command, with a consent prompt when a foreign agent layout already exists, so it is a guarded capability rather than an install-time hijack. The installed hook can still auto-allow FlyDocs workflow scripts in later Claude sessions.
Static reason
One or more suspicious static signals were detected.
Trigger
A user runs flydocs init or flydocs update in a project.
Impact
After setup, Claude can run the packaged FlyDocs workflow scripts without a separate permission prompt. The allow rule is limited to those scripts and to the flydocs MCP and flydocs run commands.
Mechanism
The CLI copies template/.claude/hooks and merges template/.claude/settings.json, including a PreToolUse command hook. auto-approve.py then emits permissionDecision allow for matching workflow-script Bash commands. Existing foreign agent setup is prompted before replacement.
AI rationale
This is first-party agent-extension setup performed by an explicit CLI command, with a consent prompt when a foreign agent layout already exists, so it is a guarded capability rather than an install-time hijack. The installed hook can still auto-allow FlyDocs workflow scripts in later Claude sessions.
Evidence
dist/cli.jstemplate/.claude/settings.jsontemplate/.claude/hooks/auto-approve.pytemplate/.cursor/hooks.json.claude/hooks.claude/settings.json.cursor/hooks.json.claude/skills.cursor/agents
Decision evidence
public snapshotAI called this Suspicious at 76.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- package.json exposes the flydocs bin and only build, test, and typecheck scripts, with no preinstall, install, or postinstall hook.
- ensureDirectories, used by init and update, creates .claude and .cursor project directories.
- runLocalInit copies template/.claude/hooks into the target project unless that path is skipped.
- The packaged Claude settings allow mcp__flydocs__* and Bash(flydocs run:*) and register a PreToolUse hook that runs auto-approve.py.
- auto-approve.py returns permissionDecision allow for Bash commands that match FlyDocs workflow scripts.
- When an existing .claude, .cursor, or AGENTS.md setup is found, init warns and asks before adoption replaces hooks.
- template/.claude/hooks/repo_context.py only resolves local workspace and repo paths for those hooks.
Evidence against
- Agent files are written only after an explicit flydocs init or update, and hook paths can be skipped.
- The auto-approve pattern is limited to python invocations of .claude/skills/flydocs-workflow/scripts and rejects shell metacharacters.
- No lifecycle script, self-dependency, or hidden credential export was found.
Source & flagged code
12 flaggeddist/cli.jsView file
•path = dist/cli.js
kind = trigger_reachable_excluded_payload
sizeBytes = 1017557
triggerReachableSource = dist/cli.js
excludedPayload = template/.claude/hooks/auto-approve.py
Critical
Trigger Reachable Excluded Directory Payload
A package entrypoint or install-reachable source explicitly loads and activates an executable-looking payload from a test, fixture, or hidden path.
dist/cli.jsView on unpkg131});
L132: import { spawnSync } from "child_process";
L133: import { readFile as readFile2, realpath } from "fs/promises";
High
122SKIP_VERSION_CHECK_ENV: () => SKIP_VERSION_CHECK_ENV,
L123: buildReExecArgv: () => buildReExecArgv,
L124: closestCommand: () => closestCommand,
High
Findings
1 Critical9 High5 Medium5 Low
CriticalTrigger Reachable Excluded Directory Payloaddist/cli.js
HighChild Processdist/cli.js
HighShelldist/cli.js
HighCredential Exfiltrationdist/cli.js
HighCredential Redirect Persistencedist/cli.js
HighCommand Output Exfiltrationdist/cli.js
HighSandbox Evasion Gated Capabilitydist/cli.js
HighTrigger Reachable Credential Exfiltrationdist/cli.js
HighRuntime Package Installdist/cli.js
HighPayload In Excluded Dirtemplate/.claude/hooks/repo_context.py
MediumDynamic Requiredist/cli.js
MediumNetwork
Affected versions and remediation
This report applies to @flydocs/cli@1.3.24.
See all versions of @flydocs/cli for other recorded verdicts.
- Review the evidence and your use of @flydocs/cli@1.3.24 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.