@flydocs/cli@1.3.28
Spec-driven development workflow: your agent works issues, sessions and the status lifecycle.
AI Security Review
scanned 10d ago · by lpm-firewall-aiSource inspection did not substantiate the scanner’s malicious verdict: the flagged Python file resolves workspace paths, and the reviewed credential flows have product-aligned purposes and destinations. The package manifest has no install lifecycle hook.
Decision evidence
public snapshot- package.json exposes dist/cli.js as the CLI and declares no install lifecycle hook; the flagged hook file resolves workspace paths.
- The credential prompt identifies Jira or Linear credentials and sends them to the FlyDocs relay; the default relay host is app.flydocs.ai.
- The Anthropic OAuth token is used for usage-status retrieval from api.anthropic.com and the result is cached locally.
- The inspected runtime dependencies expose prompt and MCP server functionality; no attack behavior was identified in the flagged files.
Source & flagged code
14 flaggedA package entrypoint or install-reachable source explicitly loads and activates an executable-looking payload from a test, fixture, or hidden path.
dist/cli.jsView on unpkgThis package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/cli.jsView on unpkgFindings
Affected versions and remediation
This report applies to @flydocs/cli@1.3.28.
See all versions of @flydocs/cli for other recorded verdicts.
- Review the evidence and your use of @flydocs/cli@1.3.28 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.