registry / @flydocs/cli / 1.3.32
@flydocs/cli@1.3.32
Spec-driven development workflow: your agent works issues, sessions and the status lifecycle.
AI Security Review
scanned 7d ago · by lpm-firewall-aiSource inspection found no malicious behavior behind the scanner signals. Credential use is limited to the Anthropic usage endpoint, and usage reporting is permission-gated.
Static reason
One or more suspicious static signals were detected.
Trigger
CLI initialization or an invoked usage-report flow; the manifest defines no install lifecycle trigger.
Impact
No confirmed malicious impact; the observed transfers support the CLI's usage and reporting features.
Mechanism
Usage reporting checks workspace consent or local configuration, while Claude usage lookup runs only when plan-status reporting is allowed.
AI rationale
Source inspection found no malicious behavior behind the scanner signals. Credential use is limited to the Anthropic usage endpoint, and usage reporting is permission-gated.
Evidence
package.jsondist/cli.jstemplate/.claude/hooks/repo_context.py
Network endpoints3
app.flydocs.ai/api/relayapi.anthropic.com/api/oauth/usageus.i.posthog.com/batch/
Decision evidence
public snapshotAI called this Clean at 93.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes the CLI entry point and has no install lifecycle hook; inspected dependency manifests and entry points show ordinary prompt and protocol functionality.
- Usage reports stop when permission is absent; permission comes from workspace consent or explicit local configuration, and plan data is collected only when plan-status permission is enabled.
- The CLI reads a Claude token locally for the Anthropic OAuth usage endpoint; the usage snapshot, rather than the token, is added to reports.
- Runtime analytics send anonymous identifiers and basic runtime details to PostHog; the CLI discloses analytics and provides a disable command.
- The flagged Python hook reads workspace configuration and resolves repository paths; its inspected code does not show payload execution.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
Source & flagged code
13 flaggeddist/cli.jsView file
•path = dist/cli.js
kind = trigger_reachable_excluded_payload
sizeBytes = 1266945
triggerReachableSource = dist/cli.js
excludedPayload = template/.claude/hooks/session-start.py
Critical
Trigger Reachable Excluded Directory Payload
A package entrypoint or install-reachable source explicitly loads and activates an executable-looking payload from a test, fixture, or hidden path.
dist/cli.jsView on unpkg141});
L142: import { spawnSync } from "child_process";
L143: import { readFile as readFile2, realpath } from "fs/promises";
High
132SKIP_VERSION_CHECK_ENV: () => SKIP_VERSION_CHECK_ENV,
L133: buildReExecArgv: () => buildReExecArgv,
L134: closestCommand: () => closestCommand,
High
Findings
1 Critical10 High5 Medium5 Low
CriticalTrigger Reachable Excluded Directory Payloaddist/cli.js
HighChild Processdist/cli.js
HighShelldist/cli.js
HighSame File Env Network Executiondist/cli.js
HighCredential Exfiltrationdist/cli.js
HighCredential Redirect Persistencedist/cli.js
HighCommand Output Exfiltrationdist/cli.js
HighSandbox Evasion Gated Capabilitydist/cli.js
HighTrigger Reachable Credential Exfiltrationdist/cli.js
HighRuntime Package Installdist/cli.js
HighPayload In Excluded Dirtemplate/.claude/hooks/repo_context.py
MediumDynamic Requiredist/cli.js
Affected versions and remediation
This report applies to @flydocs/cli@1.3.32.
See all versions of @flydocs/cli for other recorded verdicts.
- Review the evidence and your use of @flydocs/cli@1.3.32 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.