@flydocs/cli@1.3.25
Spec-driven development workflow: your agent works issues, sessions and the status lifecycle.
AI Security Review
scanned 24d ago · by lpm-firewall-aiThe source supports a conditional credential-exposure warning: initialization sends a resolved FlyDocs key to an unrestricted environment-configured relay URL. The default endpoint is package-aligned and the send is tied to an explicit CLI action, so this evidence does not establish covert theft or justify blocking publication.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A user runs `flydocs init` while `FLYDOCS_RELAY_URL` is set to an unrestricted destination and a key is resolved.
Impact
The configured recipient can receive the FlyDocs API key. The default destination is the FlyDocs relay, and no covert sending behavior was identified.
Mechanism
The CLI selects the environment-provided relay URL and sends the key in the authorization header for validation; the destination is not allowlisted in this code.
AI rationale
The source supports a conditional credential-exposure warning: initialization sends a resolved FlyDocs key to an unrestricted environment-configured relay URL. The default endpoint is package-aligned and the send is tied to an explicit CLI action, so this evidence does not establish covert theft or justify blocking publication.
Evidence
dist/cli.js
Network endpoints1
app.flydocs.ai
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- dist/cli.js lists project setup directories including Claude and Cursor paths; this is project scaffolding behavior.
- During `flydocs init`, the CLI can resolve a key and then validate it through the relay.
- The validation request uses `FLYDOCS_RELAY_URL` without destination validation, with the FlyDocs relay as its default.
- The package manifest has build and development scripts but no install lifecycle hook.
- The indicated Python hook helper reads workspace metadata and resolves repository paths.
Evidence against
- The key may be explicitly entered, obtained through browser sign-in, or resolved from existing configuration; the code reports the key source.
- The default relay is the package-aligned `app.flydocs.ai` service, so exposure depends on a user-configured relay URL.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
Source & flagged code
13 flaggeddist/cli.jsView file
•path = dist/cli.js
kind = trigger_reachable_excluded_payload
sizeBytes = 1071609
triggerReachableSource = dist/cli.js
excludedPayload = template/.claude/hooks/auto-approve.py
Critical
Trigger Reachable Excluded Directory Payload
A package entrypoint or install-reachable source explicitly loads and activates an executable-looking payload from a test, fixture, or hidden path.
dist/cli.jsView on unpkg•matchType = previous_version_dangerous_delta
matchedPackage = @flydocs/cli@1.3.24
matchedIdentity = npm:QGZseWRvY3MvY2xp:1.3.24
similarity = 0.500
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/cli.jsView on unpkg134});
L135: import { spawnSync } from "child_process";
L136: import { readFile as readFile2, realpath } from "fs/promises";
High
Findings
2 Critical9 High5 Medium5 Low
CriticalTrigger Reachable Excluded Directory Payloaddist/cli.js
CriticalPrevious Version Dangerous Deltadist/cli.js
HighChild Processdist/cli.js
HighShelldist/cli.js
HighCredential Exfiltrationdist/cli.js
HighCredential Redirect Persistencedist/cli.js
HighCommand Output Exfiltrationdist/cli.js
HighSandbox Evasion Gated Capabilitydist/cli.js
HighTrigger Reachable Credential Exfiltrationdist/cli.js
HighRuntime Package Installdist/cli.js
HighPayload In Excluded Dirtemplate/.claude/hooks/repo_context.py
MediumDynamic Require
Affected versions and remediation
This report applies to @flydocs/cli@1.3.25.
See all versions of @flydocs/cli for other recorded verdicts.
- Review the evidence and your use of @flydocs/cli@1.3.25 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.