@tiens.nguyen/gu-cli@1.0.845
Gu CLI — the gu terminal plus the local worker that runs agent / OCR / PDF / embedding jobs on your Mac (Ollama / MLX / OpenAI-compatible).
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe source establishes a conditional transfer of OCR document contents to a fixed hosted endpoint when correction settings are absent, warranting a warning. The postinstall helper is limited to PATH setup, and the reviewed agent configuration operations are gated by explicit user actions.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A worker processes an OCR job whose correction settings do not provide a destination.
Impact
Document contents may be disclosed to the hosted service; the inspected source does not establish credential theft or other misuse.
Mechanism
The worker falls back to a fixed Ollama host and posts the extracted text to its chat endpoint.
AI rationale
The source establishes a conditional transfer of OCR document contents to a fixed hosted endpoint when correction settings are absent, warranting a warning. The postinstall helper is limited to PATH setup, and the reviewed agent configuration operations are gated by explicit user actions.
Evidence
gu-cli.mjs
Network endpoints1
ollama1.getmarsic.cc
Decision evidence
public snapshotAI called this Suspicious at 79.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- OCR jobs send extracted document text through the correction step.
- When correction settings are absent, the worker falls back to a fixed hosted Ollama endpoint.
- The correction request includes the extracted text as its user message.
- Project hooks run only after approval; explicit hook commands approve or withdraw them.
- The postinstall helper is limited to global PATH setup; it skips CI and local installs.
Evidence against
- The source describes the configured correction default as the agent model server; the hosted endpoint is a fallback for older jobs or missing settings.
- The reviewed agent configuration helpers use explicit commands and scoped configuration paths.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
14 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node install-path.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgproxy-selftest.mjsView file
195patternName = generic_password
severity = medium
line = 195
Medium
mongo-native.mjsView file
18*/
L19: import { spawn } from "node:child_process";
L20: import { existsSync } from "node:fs";
High
Child Process
Package source references child process execution.
Findings
10 High6 Medium5 Low
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processmongo-native.mjs
HighShellmongo-native.mjs#virtual:normalized:round1
HighSame File Env Network Executionmongo-native.mjs
HighCredential Redirect Persistencegu-cli.mjs
HighSandbox Evasion Gated Capabilitygu-cli.mjs
HighCloud Metadata Accesscoding-provider-setup.mjs
HighCopied Package Dependency Bridgeproxy-dispatcher.mjs
HighSemantic Analysis Limitedagent-stop.mjs#virtual:normalized:round1
HighPrevious Version Dangerous Deltagu-repl.mjs
MediumSecret Patternproxy-selftest.mjs
MediumDynamic Require
Affected versions and remediation
This report applies to @tiens.nguyen/gu-cli@1.0.845.
See all versions of @tiens.nguyen/gu-cli for other recorded verdicts.
- Review the evidence and your use of @tiens.nguyen/gu-cli@1.0.845 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.