registry / @merels/cli / 0.0.8

@merels/cli@0.0.8

Developer CLI toolchain to bootstrap, build, and publish games on Merels

AI Security Review

scanned 6d ago · by lpm-firewall-ai

User-invoked CLI commands silently transmit identifying telemetry and command metadata. In a Merels project they also mutate local AI-agent skill paths.

Static reason

One or more suspicious static signals were detected.

Trigger

Running a non-connect merels CLI command in or targeting a Merels project.

Impact

Exposes Git/host/agent metadata and command data; modifies project AI-agent configuration.

Mechanism

automatic telemetry POST plus agent-skill symlink replacement

Rationale

Source confirms automatic collection and remote transmission of user and host metadata on ordinary CLI use. This is suspicious data collection, not sufficient evidence of malware or an install-time control-surface hijack.

Evidence

src/index.tssrc/telemetry.tspackage.json<gameDir>/merels.config.json<gameDir>/.merels/local.json<gameDir>/.agents/skills<gameDir>/.claude/skills<gameDir>/AGENTS.md

Network endpoints1

merels-worker.yuriplex.workers.dev/api/telemetry/event

Decision evidence

public snapshot

@merels/cli@0.0.8

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code