registry / @flydocs/cli / 1.3.4
@flydocs/cli@1.3.4
FlyDocs AI CLI — install, setup, and manage FlyDocs projects
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThis is not malicious by the stated boundary: changes require an explicit user CLI action and are first-party FlyDocs setup. The deployed agent hooks and reporting capability warrant a warning for lifecycle risk.
Static reason
One or more suspicious static signals were detected.
Trigger
User runs a FlyDocs setup command such as init, install, or update.
Impact
Installed hooks can influence agent permissions and process local transcript metadata under the FlyDocs workflow.
Mechanism
Project-scoped AI-agent extension and usage-report hook installation.
AI rationale
This is not malicious by the stated boundary: changes require an explicit user CLI action and are first-party FlyDocs setup. The deployed agent hooks and reporting capability warrant a warning for lifecycle risk.
Evidence
package.jsondist/cli.jstemplate/.claude/settings.jsontemplate/.claude/hooks/usage-capture.pytemplate/.claude/hooks/auto-approve.py.claude/hooks.claude/settings.json.claude/skills/flydocs-workflow/scripts.cursor/hooks.json
Network endpoints2
app.flydocs.ai/api/relayus.i.posthog.com/batch/
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- Explicit CLI setup copies FlyDocs hooks into a project’s .claude directory.
- Template settings register command hooks and allow FlyDocs MCP/Bash actions.
- Stop hook launches `flydocs usage report` after agent responses.
Evidence against
- package.json has no preinstall/install/postinstall lifecycle hook.
- Agent configuration changes occur through explicit CLI commands, with prompts/backups for existing agent setups.
- Usage reporting is consent-gated and offers environment and local opt-out controls.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
13 flaggeddist/cli.jsView file
•path = dist/cli.js
kind = trigger_reachable_excluded_payload
sizeBytes = 774932
triggerReachableSource = dist/cli.js
excludedPayload = template/.claude/hooks/auto-approve.py
Critical
Trigger Reachable Excluded Directory Payload
A package entrypoint or install-reachable source explicitly loads and activates an executable-looking payload from a test, fixture, or hidden path.
dist/cli.jsView on unpkg123});
L124: import { spawnSync } from "child_process";
L125: import { readFile as readFile2, realpath } from "fs/promises";
High
114SKIP_VERSION_CHECK_ENV: () => SKIP_VERSION_CHECK_ENV,
L115: buildReExecArgv: () => buildReExecArgv,
L116: closestCommand: () => closestCommand,
High
114
Findings
1 Critical10 High5 Medium5 Low
CriticalTrigger Reachable Excluded Directory Payloaddist/cli.js
HighChild Processdist/cli.js
HighShelldist/cli.js
HighCredential Exfiltrationdist/cli.js
HighCredential Redirect Persistencedist/cli.js
HighEntrypoint Foreign Package Code Overwritedist/cli.js
HighCommand Output Exfiltrationdist/cli.js
HighSandbox Evasion Gated Capabilitydist/cli.js
HighTrigger Reachable Credential Exfiltrationdist/cli.js
HighRuntime Package Installdist/cli.js
HighPayload In Excluded Dirtemplate/.claude/hooks/repo_context.py
MediumDynamic Require
Affected versions and remediation
This report applies to @flydocs/cli@1.3.4.
See all versions of @flydocs/cli for other recorded verdicts.
- Review the evidence and your use of @flydocs/cli@1.3.4 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.