@tsuga/cli@1.79.0
Tsuga CLI - manage resources from the command line
AI Security Review
scanned 10d ago · by lpm-firewall-aiThe source shows a user-invoked setup capability that enables agent prompt telemetry by default, creating unresolved privacy risk. The inspected behavior does not establish covert collection or an install-time attack.
Static reason
One or more suspicious static signals were detected.
Trigger
The user invokes the CLI setup command for Claude Code or Codex.
Impact
Private agent conversation and tool content may be disclosed to the configured telemetry destination after setup.
Mechanism
The command writes telemetry settings to the agent’s global configuration, using the configured endpoint and ingestion key; Claude prompt and tool-content logging defaults to enabled.
AI rationale
The source shows a user-invoked setup capability that enables agent prompt telemetry by default, creating unresolved privacy risk. The inspected behavior does not establish covert collection or an install-time attack.
Evidence
dist/cli.js~/.claude/settings.json~/.codex/config.toml
Decision evidence
public snapshotAI called this Suspicious at 87.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The setup command writes telemetry settings to Claude Code’s global configuration, including flags for prompt and tool-content logging.
- Including prompts and tool content is enabled by default; the option to exclude them is available.
- The Codex setup configures prompt logging and sends telemetry to the configured endpoint using its bearer key.
Evidence against
- This configuration change requires an explicit setup command; the endpoint and ingestion key are caller-supplied.
- The manifest exposes a CLI entry point and lists build and packaging scripts; the reviewed manifest has no install lifecycle hook.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
16 flaggeddist/cli.jsView file
268patternName = github_pat
severity = critical
line = 268
Critical
268patternName = github_pat
severity = critical
line = 268
Critical
268patternName = github_oauth
severity = critical
line = 268
Critical
268patternName = github_server_token
severity = critical
line = 268
Critical
Findings
9 Critical7 High2 Medium4 Low
CriticalCritical Secretdist/cli.js
CriticalSecret Patterndist/cli.js
CriticalSecret Patterndist/cli.js
CriticalSecret Patterndist/cli.js
CriticalSecret Patterndist/cli.js
CriticalSecret Patterndist/cli.js
CriticalSecret Patterndist/cli.js
CriticalSecret Patterndist/cli.js
CriticalSecret Patterndist/cli.js
HighChild Processdist/cli.js
HighSame File Env Network Executiondist/cli.js
HighCommand Output Exfiltrationdist/cli.js
HighTrigger Reachable Command Output Exfiltration
Affected versions and remediation
This report applies to @tsuga/cli@1.79.0.
See all versions of @tsuga/cli for other recorded verdicts.
- Review the evidence and your use of @tsuga/cli@1.79.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.