@tsuga/cli@1.63.0
Tsuga CLI - manage resources from the command line
AI Security Review
scanned 21d ago · by lpm-firewall-aiThe default prompt and tool-content export in explicit Claude setup is a risky agent configuration capability, warranting a warning. The inspected API credential flow restricts destinations to Tsuga HTTPS hosts or localhost, so the flagged credential-redirection behavior was not confirmed.
Static reason
One or more suspicious static signals were detected.
Trigger
A user runs the Claude telemetry setup command or the Claude plugin installer.
Impact
Claude may export private prompts and tool content to the configured telemetry endpoint; the plugin may update automatically from the registered Tsuga marketplace.
Mechanism
The telemetry setup writes the caller-supplied endpoint and bearer key into the user's Claude settings and enables prompt and tool-content logging by default. The plugin installer can register the Tsuga marketplace with automatic updates enabled.
AI rationale
The default prompt and tool-content export in explicit Claude setup is a risky agent configuration capability, warranting a warning. The inspected API credential flow restricts destinations to Tsuga HTTPS hosts or localhost, so the flagged credential-redirection behavior was not confirmed.
Evidence
dist/cli.js~/.claude/settings.json
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The Claude setup command accepts an OTLP endpoint and ingestion key; prompt and tool-content inclusion is enabled by default.
- The setup writes the endpoint, bearer key, and prompt and tool-content telemetry settings to the user's Claude settings file.
- The explicit Claude plugin installer can set automatic updates for the Tsuga plugin marketplace.
- The package manifest defines no install lifecycle hook.
- The API credential flow validates destinations against Tsuga HTTPS hosts or localhost and sends credentials to that validated API URL.
Evidence against
- The agent configuration changes are reachable through explicit CLI setup and plugin commands.
- The inspected login flow uses browser authorization and saves the resulting session.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedPossibleObfuscation
Source & flagged code
13 flaggeddist/cli.jsView file
83patternName = github_pat
severity = critical
line = 83
Critical
83patternName = github_pat
severity = critical
line = 83
Critical
83patternName = github_oauth
severity = critical
line = 83
Critical
83patternName = github_server_token
severity = critical
line = 83
Critical
Findings
9 Critical4 High2 Medium4 Low
CriticalCritical Secretdist/cli.js
CriticalSecret Patterndist/cli.js
CriticalSecret Patterndist/cli.js
CriticalSecret Patterndist/cli.js
CriticalSecret Patterndist/cli.js
CriticalSecret Patterndist/cli.js
CriticalSecret Patterndist/cli.js
CriticalSecret Patterndist/cli.js
CriticalSecret Patterndist/cli.js
HighCredential Redirect Persistencedist/cli.js
HighSecret Patterndist/cli.js
HighSecret Patterndist/cli.js
HighSecret Patterndist/cli.js
Affected versions and remediation
This report applies to @tsuga/cli@1.63.0.
See all versions of @tsuga/cli for other recorded verdicts.
- Review the evidence and your use of @tsuga/cli@1.63.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.