registry / @flydocs/cli / 1.3.30
@flydocs/cli@1.3.30
Spec-driven development workflow: your agent works issues, sessions and the status lifecycle.
AI Security Review
scanned 8d ago · by lpm-firewall-aiSource inspection found no install hook or concrete attack behavior. Static matches resolve to product authentication, opt-out-capable analytics, an explicit self-update path, and repository-context helpers.
Static reason
One or more suspicious static signals were detected.
Trigger
The CLI runs when invoked; the self-update command requires an explicit command and confirmation.
Impact
No confirmed attack impact; the inspected credential transfers serve their named authentication flows.
Mechanism
The inspected source performs service-specific authentication, configurable usage analytics, and an explicit self-update. No hidden payload activation or unrelated credential recipient was found.
AI rationale
Source inspection found no install hook or concrete attack behavior. Static matches resolve to product authentication, opt-out-capable analytics, an explicit self-update path, and repository-context helpers.
Network endpoints4
app.flydocs.ai/api/relayclerk.flydocs.aiapi.linear.app/graphqlus.i.posthog.com/batch/
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes a CLI entrypoint and contains no install lifecycle hook.
- FlyDocs credentials go to the FlyDocs relay or Clerk by default; the Linear validator sends a supplied key to Linear’s API.
- Telemetry checks its stored setting and environment opt-out before sending queued events to PostHog.
- The npm install behavior belongs to the self-update command, which asks before updating.
- The flagged Python file resolves repository and worktree paths.
- Inspected bundled dependency entrypoints and MCP event handlers show library and filtered subscription behavior.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
13 flaggeddist/cli.jsView file
•path = dist/cli.js
kind = trigger_reachable_excluded_payload
sizeBytes = 1174172
triggerReachableSource = dist/cli.js
excludedPayload = template/.claude/hooks/auto-approve.py
Critical
Trigger Reachable Excluded Directory Payload
A package entrypoint or install-reachable source explicitly loads and activates an executable-looking payload from a test, fixture, or hidden path.
dist/cli.jsView on unpkg141});
L142: import { spawnSync } from "child_process";
L143: import { readFile as readFile2, realpath } from "fs/promises";
High
132SKIP_VERSION_CHECK_ENV: () => SKIP_VERSION_CHECK_ENV,
L133: buildReExecArgv: () => buildReExecArgv,
L134: closestCommand: () => closestCommand,
High
Findings
1 Critical10 High5 Medium5 Low
CriticalTrigger Reachable Excluded Directory Payloaddist/cli.js
HighChild Processdist/cli.js
HighShelldist/cli.js
HighSame File Env Network Executiondist/cli.js
HighCredential Exfiltrationdist/cli.js
HighCredential Redirect Persistencedist/cli.js
HighCommand Output Exfiltrationdist/cli.js
HighSandbox Evasion Gated Capabilitydist/cli.js
HighTrigger Reachable Credential Exfiltrationdist/cli.js
HighRuntime Package Installdist/cli.js
HighPayload In Excluded Dirtemplate/.claude/hooks/repo_context.py
MediumDynamic Requiredist/cli.js
Affected versions and remediation
This report applies to @flydocs/cli@1.3.30.
See all versions of @flydocs/cli for other recorded verdicts.
- Review the evidence and your use of @flydocs/cli@1.3.30 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.