registry / @flydocs/cli / 1.3.5
@flydocs/cli@1.3.5
FlyDocs AI CLI — install, setup, and manage FlyDocs projects
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThis is a first-party, explicit-user-command agent extension setup with hooks and auto-approval behavior, so it warrants a warning under the policy. No concrete malicious install-time or covert attack chain was found.
Static reason
One or more suspicious static signals were detected.
Trigger
User runs `flydocs init` or `flydocs install` in a project.
Impact
Changes project AI-agent behavior and can invoke FlyDocs workflow commands; usage counters may be sent after configured consent.
Mechanism
Project-local AI-agent hook and skill deployment with consent-gated usage telemetry.
AI rationale
This is a first-party, explicit-user-command agent extension setup with hooks and auto-approval behavior, so it warrants a warning under the policy. No concrete malicious install-time or covert attack chain was found.
Evidence
package.jsondist/cli.jstemplate/.claude/settings.jsontemplate/.claude/hooks/auto-approve.pytemplate/.claude/hooks/usage-capture.py.claude/settings.json.claude/hooks/auto-approve.py.claude/hooks/usage-capture.py.claude/skills/flydocs-workflow/
Network endpoints1
app.flydocs.ai/api/relay
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- Explicit `flydocs install` forwards into project initialization.
- The deployed Claude settings enable command hooks; its auto-approve hook permits FlyDocs workflow scripts.
- A Stop hook launches `flydocs usage report`; reporting is gated by workspace consent.
- Usage payload construction contains counters/metadata, not transcript or prompt text.
Evidence against
- package.json has no preinstall, install, or postinstall lifecycle hook.
- Agent configuration changes require an explicit CLI invocation, not npm installation.
- The usage path honors machine/environment opt-out and denies reporting without credentials or consent.
- Observed relay is FlyDocs-branded; no unrelated exfiltration endpoint or remote code loader was found.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStrings
Source & flagged code
13 flaggeddist/cli.jsView file
•path = dist/cli.js
kind = trigger_reachable_excluded_payload
sizeBytes = 792394
triggerReachableSource = dist/cli.js
excludedPayload = template/.claude/hooks/auto-approve.py
Critical
Trigger Reachable Excluded Directory Payload
A package entrypoint or install-reachable source explicitly loads and activates an executable-looking payload from a test, fixture, or hidden path.
dist/cli.jsView on unpkg123});
L124: import { spawnSync } from "child_process";
L125: import { readFile as readFile2, realpath } from "fs/promises";
High
114SKIP_VERSION_CHECK_ENV: () => SKIP_VERSION_CHECK_ENV,
L115: buildReExecArgv: () => buildReExecArgv,
L116: closestCommand: () => closestCommand,
High
114
Findings
1 Critical10 High5 Medium5 Low
CriticalTrigger Reachable Excluded Directory Payloaddist/cli.js
HighChild Processdist/cli.js
HighShelldist/cli.js
HighCredential Exfiltrationdist/cli.js
HighCredential Redirect Persistencedist/cli.js
HighEntrypoint Foreign Package Code Overwritedist/cli.js
HighCommand Output Exfiltrationdist/cli.js
HighSandbox Evasion Gated Capabilitydist/cli.js
HighTrigger Reachable Credential Exfiltrationdist/cli.js
HighRuntime Package Installdist/cli.js
HighPayload In Excluded Dirtemplate/.claude/hooks/repo_context.py
MediumDynamic Require
Affected versions and remediation
This report applies to @flydocs/cli@1.3.5.
See all versions of @flydocs/cli for other recorded verdicts.
- Review the evidence and your use of @flydocs/cli@1.3.5 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.