@tsuga/cli@1.23.0
Tsuga CLI - manage resources from the command line
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe explicit command mutates agent configuration and enables later updates, which warrants a capability warning. The manifest has no install hook and the inspected credential endpoint validation is restricted.
Static reason
One or more suspicious static signals were detected.
Trigger
A user runs the CLI install plugin command for Claude Code.
Impact
A user who runs this setup command grants the configured marketplace future update capability; no confirmed covert attack surface was established.
Mechanism
The command installs a marketplace plugin, then writes the user's Claude settings file with automatic updates enabled unless the user supplies the opt-out flag.
AI rationale
The explicit command mutates agent configuration and enables later updates, which warrants a capability warning. The manifest has no install hook and the inspected credential endpoint validation is restricted.
Evidence
dist/cli.js.claude/settings.json
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The manifest exposes a CLI entry point and contains no package-install lifecycle hook.
- The explicit install plugin commands invoke Claude and Codex plugin installation commands.
- The Claude plugin command writes the user's Claude settings file and enables automatic marketplace updates.
- Credential destinations are restricted to Tsuga API hosts or local hosts.
Evidence against
- No automatic install-time agent configuration was identified.
- The agent configuration behavior is reached only through named CLI subcommands.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
16 flaggeddist/cli.jsView file
50patternName = github_pat
severity = critical
line = 50
Critical
50patternName = github_pat
severity = critical
line = 50
Critical
50patternName = github_oauth
severity = critical
line = 50
Critical
50patternName = github_server_token
severity = critical
line = 50
Critical
Findings
9 Critical7 High2 Medium4 Low
CriticalCritical Secretdist/cli.js
CriticalSecret Patterndist/cli.js
CriticalSecret Patterndist/cli.js
CriticalSecret Patterndist/cli.js
CriticalSecret Patterndist/cli.js
CriticalSecret Patterndist/cli.js
CriticalSecret Patterndist/cli.js
CriticalSecret Patterndist/cli.js
CriticalSecret Patterndist/cli.js
HighChild Processdist/cli.js
HighSame File Env Network Executiondist/cli.js
HighCommand Output Exfiltrationdist/cli.js
HighTrigger Reachable Command Output Exfiltration
Affected versions and remediation
This report applies to @tsuga/cli@1.23.0.
See all versions of @tsuga/cli for other recorded verdicts.
- Review the evidence and your use of @tsuga/cli@1.23.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.