@flydocs/cli@1.3.9
FlyDocs AI CLI — install, setup, and manage FlyDocs projects
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe inspected source establishes user-command agent configuration mutation, including a configurable global permission destination. No install lifecycle trigger or concrete malicious attack was established, so the supplied policy requires a warning rather than blocking publication.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
The user invokes flydocs update.
Impact
Agent execution hooks and permissions can change; later explicit updates reuse the saved policy without a separate permission prompt at the inspected caller.
Mechanism
The command replaces template-managed hooks and applies a saved permission policy to project or user-global Claude settings.
AI rationale
The inspected source establishes user-command agent configuration mutation, including a configurable global permission destination. No install lifecycle trigger or concrete malicious attack was established, so the supplied policy requires a warning rather than blocking publication.
Evidence
dist/cli.js.claude/hooks.claude/settings.json
Decision evidence
public snapshotAI called this Suspicious at 94.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The explicit update command replaces project Claude hooks and writes managed agent permissions.
- Update reads the saved permission policy; its destination can be project or user-global Claude settings.
- The CLI exposes update as a user-invoked command, and package.json has no npm install lifecycle hooks.
- The indicated directory helper creates agent skill and command directories.
- The Python helper maintains local repository session state.
Evidence against
- No concrete malware attack was established by the inspected source.
- Permission writes preserve a backup of existing settings and support an off mode.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
13 flaggeddist/cli.jsView file
•path = dist/cli.js
kind = trigger_reachable_excluded_payload
sizeBytes = 820119
triggerReachableSource = dist/cli.js
excludedPayload = template/.claude/hooks/auto-approve.py
Critical
Trigger Reachable Excluded Directory Payload
A package entrypoint or install-reachable source explicitly loads and activates an executable-looking payload from a test, fixture, or hidden path.
dist/cli.jsView on unpkg•matchType = previous_version_dangerous_delta
matchedPackage = @flydocs/cli@1.3.24
matchedIdentity = npm:QGZseWRvY3MvY2xp:1.3.24
similarity = 0.500
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/cli.jsView on unpkg130});
L131: import { spawnSync } from "child_process";
L132: import { readFile as readFile2, realpath } from "fs/promises";
High
Findings
2 Critical9 High5 Medium5 Low
CriticalTrigger Reachable Excluded Directory Payloaddist/cli.js
CriticalPrevious Version Dangerous Deltadist/cli.js
HighChild Processdist/cli.js
HighShelldist/cli.js
HighCredential Exfiltrationdist/cli.js
HighCredential Redirect Persistencedist/cli.js
HighCommand Output Exfiltrationdist/cli.js
HighSandbox Evasion Gated Capabilitydist/cli.js
HighTrigger Reachable Credential Exfiltrationdist/cli.js
HighRuntime Package Installdist/cli.js
HighPayload In Excluded Dirtemplate/.claude/hooks/repo_context.py
MediumDynamic Require
Affected versions and remediation
This report applies to @flydocs/cli@1.3.9.
See all versions of @flydocs/cli for other recorded verdicts.
- Review the evidence and your use of @flydocs/cli@1.3.9 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.