@flydocs/cli@1.3.35
Spec-driven development workflow: your agent works issues, sessions and the status lifecycle.
AI Security Review
scanned 3d ago · by lpm-firewall-aiThis is suspicious runtime telemetry rather than credential theft: reporting is workspace-gated and has an opt-out, but its records can include repository and session identifiers beyond the stated notice. The manifest has no install lifecycle hook, and the Claude OAuth token is used with Anthropic’s own usage endpoint.
Static reason
One or more suspicious static signals were detected.
Trigger
The installed Claude hook runs when an agent finishes a response; the CLI reports only when workspace analytics are enabled and the user has not opted out.
Impact
FlyDocs may receive identifying session or repository metadata beyond the notice’s stated token counts and estimated cost.
Mechanism
The hook passes the transcript path to flydocs usage report. The CLI posts usage records to the FlyDocs relay; records may include session IDs, repository slugs and host data.
AI rationale
This is suspicious runtime telemetry rather than credential theft: reporting is workspace-gated and has an opt-out, but its records can include repository and session identifiers beyond the stated notice. The manifest has no install lifecycle hook, and the Claude OAuth token is used with Anthropic’s own usage endpoint.
Evidence
dist/cli.jstemplate/.claude/hooks/usage-capture.py~/.claude/.credentials.json~/.flydocs/plan-status-cache.json
Network endpoints1
app.flydocs.ai/api/relay/usage/sessions
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- A Stop hook launches usage reporting, which posts records to the FlyDocs relay; reporting is gated by the workspace’s server-side analytics setting.
- The records can include session IDs, repository slugs and host data, while the notice describes collection as token counts and estimated cost only.
Evidence against
- package.json defines no install, preinstall or postinstall lifecycle script.
- Usage reporting is gated by workspace consent and supports a local opt-out.
- The Claude OAuth token is used for an Anthropic usage request to api.anthropic.com, its own service.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
13 flaggeddist/cli.jsView file
•path = dist/cli.js
kind = trigger_reachable_excluded_payload
sizeBytes = 1358368
triggerReachableSource = dist/cli.js
excludedPayload = template/.claude/hooks/session-start.py
Critical
Trigger Reachable Excluded Directory Payload
A package entrypoint or install-reachable source explicitly loads and activates an executable-looking payload from a test, fixture, or hidden path.
dist/cli.jsView on unpkg142});
L143: import { spawnSync } from "child_process";
L144: import { readFile as readFile2, realpath } from "fs/promises";
High
133SKIP_VERSION_CHECK_ENV: () => SKIP_VERSION_CHECK_ENV,
L134: buildReExecArgv: () => buildReExecArgv,
L135: closestCommand: () => closestCommand,
High
Findings
1 Critical10 High5 Medium5 Low
CriticalTrigger Reachable Excluded Directory Payloaddist/cli.js
HighChild Processdist/cli.js
HighShelldist/cli.js
HighSame File Env Network Executiondist/cli.js
HighCredential Exfiltrationdist/cli.js
HighCredential Redirect Persistencedist/cli.js
HighCommand Output Exfiltrationdist/cli.js
HighSandbox Evasion Gated Capabilitydist/cli.js
HighTrigger Reachable Credential Exfiltrationdist/cli.js
HighRuntime Package Installdist/cli.js
HighPayload In Excluded Dirtemplate/.claude/hooks/repo_context.py
MediumDynamic Requiredist/cli.js
Affected versions and remediation
This report applies to @flydocs/cli@1.3.35.
See all versions of @flydocs/cli for other recorded verdicts.
- Review the evidence and your use of @flydocs/cli@1.3.35 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.