@flydocs/cli@1.3.34
Spec-driven development workflow: your agent works issues, sessions and the status lifecycle.
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe manifest has no install-time hook, and the flagged executable references resolve to the CLI’s update and workflow functions. Credential requests target FlyDocs services, while usage telemetry sends anonymous runtime metadata and provides an opt-out.
Decision evidence
public snapshot- The manifest has no install, preinstall, or postinstall hook; its scripts are build and development tasks.
- Relay credentials are sent to the FlyDocs relay host, with a user-configurable relay URL.
- Telemetry uses a random anonymous ID and basic runtime metadata, and can be disabled with FLYDOCS_TELEMETRY=0.
- The flagged repo_context.py file resolves workspace and worktree paths for workflow hooks.
Source & flagged code
14 flaggedA package entrypoint or install-reachable source explicitly loads and activates an executable-looking payload from a test, fixture, or hidden path.
dist/cli.jsView on unpkgThis package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/cli.jsView on unpkgFindings
Affected versions and remediation
This report applies to @flydocs/cli@1.3.34.
See all versions of @flydocs/cli for other recorded verdicts.
- Review the evidence and your use of @flydocs/cli@1.3.34 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.