registry / @flydocs/cli / 1.3.3
@flydocs/cli@1.3.3
FlyDocs AI CLI — install, setup, and manage FlyDocs projects
AI Security Review
scanned 3mo ago · by lpm-firewall-aiSource confirms an explicit-user-command, first-party AI-agent extension setup with persistent hooks and usage reporting. No install-time lifecycle execution, credential theft, remote payload execution, or broad foreign control-surface mutation was found.
Static reason
One or more suspicious static signals were detected.
Trigger
User runs `flydocs init` in a project, then configured agent hook events occur.
Impact
Persistent project AI-agent hooks and scoped permissions; no unconsented npm install-time mutation or concrete malicious chain was confirmed.
Mechanism
project-scoped agent extension installation and consent-gated usage capture
AI rationale
Source confirms an explicit-user-command, first-party AI-agent extension setup with persistent hooks and usage reporting. No install-time lifecycle execution, credential theft, remote payload execution, or broad foreign control-surface mutation was found.
Evidence
dist/cli.jstemplate/.claude/settings.jsontemplate/.claude/hooks/usage-capture.py.claude/settings.json.cursor/hooks.json.claude/hooks/usage-capture.py.claude/skills/flydocs-workflow/AGENTS.md
Network endpoints2
app.flydocs.ai/api/relayus.i.posthog.com/batch/
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- Explicit `flydocs init` installs FlyDocs settings and Cursor hooks into the target project.
- Installed Claude settings grant FlyDocs MCP/Bash permissions and register command hooks.
- A Stop hook launches detached usage reporting against agent transcript input.
- CLI usage reporting is consent-gated before parsing and posting records.
Evidence against
- package.json has no preinstall, install, postinstall, or prepare lifecycle hook.
- Agent configuration changes occur through the explicit `flydocs init` command, not npm installation.
- Permissions and endpoints are FlyDocs-scoped; no obfuscated payload, arbitrary shell execution, or credential diversion was found.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
13 flaggeddist/cli.jsView file
•path = dist/cli.js
kind = trigger_reachable_excluded_payload
sizeBytes = 772566
triggerReachableSource = dist/cli.js
excludedPayload = template/.claude/hooks/auto-approve.py
Critical
Trigger Reachable Excluded Directory Payload
A package entrypoint or install-reachable source explicitly loads and activates an executable-looking payload from a test, fixture, or hidden path.
dist/cli.jsView on unpkg123});
L124: import { spawnSync } from "child_process";
L125: import { readFile as readFile2, realpath } from "fs/promises";
High
114SKIP_VERSION_CHECK_ENV: () => SKIP_VERSION_CHECK_ENV,
L115: buildReExecArgv: () => buildReExecArgv,
L116: closestCommand: () => closestCommand,
High
114
Findings
1 Critical10 High5 Medium5 Low
CriticalTrigger Reachable Excluded Directory Payloaddist/cli.js
HighChild Processdist/cli.js
HighShelldist/cli.js
HighCredential Exfiltrationdist/cli.js
HighCredential Redirect Persistencedist/cli.js
HighEntrypoint Foreign Package Code Overwritedist/cli.js
HighCommand Output Exfiltrationdist/cli.js
HighSandbox Evasion Gated Capabilitydist/cli.js
HighTrigger Reachable Credential Exfiltrationdist/cli.js
HighRuntime Package Installdist/cli.js
HighPayload In Excluded Dirtemplate/.claude/hooks/repo_context.py
MediumDynamic Require
Affected versions and remediation
This report applies to @flydocs/cli@1.3.3.
See all versions of @flydocs/cli for other recorded verdicts.
- Review the evidence and your use of @flydocs/cli@1.3.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.