registry / @uge/payo / 1.1.1

@uge/payo@1.1.1

CLI tool to generate AI rules and skills for your project

AI Security Review

scanned 10d ago · by lpm-firewall-ai

No confirmed malicious attack surface was found. The package is a user-invoked CLI that generates AI-assistant guidance files and can optionally drive locally installed AI CLIs.

Static reason

One or more suspicious static signals were detected.

Trigger

User runs payo/npx @uge/payo and chooses generation options

Impact

Creates or renames documented guidance files in the current project; optional selected AI CLIs may contact their own providers under the user's account.

Mechanism

Interactive local file generation with optional AI CLI subprocesses

Rationale

The suspicious primitives are aligned with the documented CLI functionality and require explicit runtime use; there is no install-time execution, hidden endpoint, credential harvesting, or unconsented AI-agent control-surface mutation. Optional subprocess execution targets known local AI assistant CLIs to write requested guidance files.

Evidence

package.jsonREADME.mddist/index.jsAGENTS.mdCLAUDE.md.cursorrules.cursor/rules/**.github/copilot-instructions.md.github/instructions/**.claude/skills/**.agents/skills/**.windsurfrulesAI_RULES.md.payo/**bootstrap-prompt.md

Decision evidence

public snapshot

AI called this Clean at 88.0% confidence as Benign with low false-positive risk.

Evidence for block

dist/index.js imports child_process spawn/spawnSync for optional AI CLI execution
dist/index.js defines agent args with permissive flags for claude/copilot/antigravity/codex when user selects those tools
dist/index.js can write AI guidance files such as AGENTS.md, CLAUDE.md, .cursorrules, and .claude/skills/**

Evidence against

package.json has no install/preinstall/postinstall lifecycle hooks
README.md describes the CLI purpose: generate AI assistant rules/skills in the current project
dist/index.js only activates generation through the payo CLI flow, not on package import/install
dist/index.js network-like behavior is delegated to locally installed AI CLIs; no hardcoded exfiltration endpoint found
dist/index.js uses fs writes/renames for documented project artifacts and .payo session state
Scanner eval signal appears from bundled zod/JIT code, not package attack logic

Behavioral surface

Source

ChildProcessEnvironmentVarsEvalFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 471 KB of source, external domains: github.com, json-schema.org

Source & flagged code

4 flagged

dist/index.jsView file

Lines 63-103javascript

63`);t.length>1&&n.write(_v.cursor.up(t.length-1)),n.write(_v.cursor.to(0)),n.write(_v.erase.down())},w=(t)=>t.replace(/\.+$/,""),br=(t)=>{let kr=(performance.now()-t)/1000,Rr=Math.floor(kr/60),lr=Math.floor(kr%60);return Rr>0?`[${Rr}m ${lr}s]`:`[${lr}s]`},ir=U.withGuide??rr.withGuide,U$=(t="")=>{N=!0,D=c1({output:n}),k=w(t),E=performance.now(),ir&&n.write(`${W("gray",B)}

64`);let kr=0,Rr=0;d(),z=setInterval(()=>{if(b&&k===G)return;H(),G=k;let lr=a(i[kr]),$n;if(b)$n=`${lr} ${k}...`;else if(r==="timer")$n=`${lr} ${k} ${br(E)}`;else{let d2=".".repeat(Math.floor(Rr)).slice(0,3);$n=`${lr} ${k}${d2}`}let y2=Sr($n,y,{hard:!0,trim:!1});n.write(y2),kr=kr+1<i.length?kr+1:0,Rr=Rr<4?Rr+0.125:0},u)},K$=(t="",kr=0,Rr=!1)=>{if(!N)return;N=!1,clearInterval(z),H();let lr=kr===0?W("green",zn):kr===1?W("red",T1):W("red",f1);k=t??k,Rr||(r==="timer"?n.write(`${lr} ${k} ${br(E)}

65`):n.write(`${lr} ${k}

66`)),V(),D()};return{start:U$,stop:(t="")=>K$(t,0),message:(t="")=>{k=w(t??k)},cancel:(t="")=>K$(t,1),error:(t="")=>K$(t,2),clear:()=>K$("",0,!0),get isCancelled(){return j}}},o3={light:x("─","-"),heavy:x("━","="),block:x("█","#")};var bn=(r,v)=>r.includes(`

67`)?r.split(`

68`).map((n)=>v(n)).join(`

69`):v(r),b$=(r)=>{let v=(n,g)=>{let $=n.label??String(n.value);switch(g){case"disabled":return`${W("gray",Dn)} ${bn($,(i)=>W("gray",i))}${n.hint?` ${W("dim",`(${n.hint??"disabled"})`)}`:""}`;case"selected":return`${bn($,(i)=>W("dim",i))}`;case"active":return`${W("green",Rg)} ${$}${n.hint

70`:""}${i}

71`;switch(this.state){case"submit":{let I=n?`${W("gray",B)} `:"",U=pr(r.output,v(this.options[this.cursor],"selected"),I);return`${u}${U}`}case"cancel":{let

72${W("gray",B)}`:""}`}default:{let I=n?`${W("cyan",B)} `:"",U=n?W("cyan",er):"",b=u.split(`

73`).length,D=n?2:1;return`${u}${I}${lg({output:r.output,cursor:this.cursor,options:this.options,maxItems:r.maxItems,columnPadding:I.length,rowPadding:b+D,style:(z,N)=>

74${I}`)}

75${U}

76`}}}}).prompt()};var S3=`${W("gray",B)} `;var jn=(r)=>new wg({validate:r.validate,placeholder:r.placeholder,defaultValue:r.defaultValue,initialValue:r.initialValue,output:r.output,signal:r.signal,input:r.input,render(){let v=r?.withGuide??rr.withGuide,n=`${`${v?`${W("gray",B)}

77`:""}${_n(this.state)} `}${r.message}

78`,g=r.placeholder?W("inverse",r.placeholder[0])+W("dim",r.placeholder.slice(1)):W(["inverse","hidden"],"_"),$=this.userInput?this.userInputWithCursor:g,i=this.value??"";switch(this.state){case"error":{

79${I}${$}

80${U}${u}

81`}case"submit":{let u=i?` ${W("dim",i)}`:"",I=v?W("gray",B):"";return`${n}${I}${u}`}case"cancel":{let u=i?` ${

82${I}`:""}`}default:{let u=v?`${W("cyan",B)} `:"",I=v?W("cyan",er):"";return`${n}${u}${$}

83${I}

84`}}}}).prompt();import dv from"fs";import BW from"path";import{randomUUID as AW}from"crypto";var Gr={};xr(Gr,{xor:()=>VD,xid:()=>d0,void:()=>LD,uuidv7:()=>l0,uuidv6:()=>R0,uuidv4

85`)}var Q$=(r)=>(v,n,g,$)=>{let i=g?{...g,async:!1}:{async:!1},u=v._zod.run({value:n,issues:[]},i);if(u instanceof Promise)throw new Mr;if(u.issues.length){let I=new($?.Err??r)(u.issues.map((U)=>_r(U,i,p())));throw kn(I,$?.callee),I}return u.value},Wn=Q$(Lr),V$=(r)=>async(v,n,g,$)=>{let i=g?{...g,async:!0}:{async:!0},u=v._zod.run({value:n,issues:[]},i);if(u instanceof Promise)u=await u;if(u.issues.length){let I=new($?.Err??r)(u.issues.map((U)=>_r(U,i,p())));throw kn(I,$?.callee),I}return u.value},Xn=V$(Lr),H$=(r)=>(v,n,g)=>{let $=g?{...g,async:!1}:{async:!1},i=v._zod.run({value:n,issues:[]},$); ...

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/index.jsView on unpkg · L83

86`).filter((i)=>i),g=Math.min(...n.map((i)=>i.length-i.trimStart().length)),$=n.map((i)=>i.slice(g)).map((i)=>" ".repeat(this.indent*2)

87`))}}var su={major:4,minor:4,patch:3};var o=_("$ZodType",(r,v)=>{var n;r??(r={}),r._zod.def=v,r._zod.bag=r._zod.bag||{},r._zod.version=su;let g=[...r._zod.def.checks??[]];if(r._zod.traits.has("$ZodCheck"))g.unshift

88 if (${S}.issues.length) {

89 if (${O} in input) {

90 payload.issues = payload.issues.concat(${S}.issues.map(iss => ({

91 ...iss,

92 path: iss.path ? [${O}, ...iss.path] : [${O}]

93 })));

94 }

95 }

97 if (${S}.value === undefined) {

98 if (${O} in input) {

99 newResult[${O}] = undefined;

100 }

101 } else {

102 newResult[${O}] = ${S}.value;

103 }

Long lines were clipped for display.

Lines 141-191javascript

141 }

142 } else {

143 newResult[${O}] = ${S}.value;

144 }

145

146 `)}j.write("payload.value = newResult;"),j.write("return payload;");let a=j.compile();return(l,S)=>a(N,l,S)},i,u=_$,I=!D$.jitless,b=I&&dg.value,D=v.catchall,z;r._zod.parse=(N,j)=>{z??(z=g.value);let k=N.value;if(!u(k))return N.issues.push({expected:"object",code:"invalid_type",input:k,inst:r}),N;if(I&&b&&j?.async===!1&&j.jitless!==!0){if(!i)i=$(v.shape);if(N=i(N,j),!D)return N;return Q0([],k,N,j,z,r)}return n(N,j)}});function b0(r,v,n,g){for(let i of r)if(i.issues.length===0)return v.value=i.value,v;let $=r.filter((i)=>!$$(i));if($.length===1)return v.value=$[0].value,$[0];return v.issue ...

147

148Set the \`cycles\` parameter to \`"ref"\`

Source & flagged code

4 flagged · loading source

dist/index.jsView file

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L171

171`)+` L172: `}var W_={id:"cursor",displayName:"Cursor",knownArtifacts:[".cursorrules",".cursor/rules"],generate:(r)=>[{path:".cursorrules",content:vr("Cursor Rules",r.sections)}],agent:{binary... L173: `),I=v.map((b)=>`- ${b}: one of [${ab(b,g).join(", ")}]`).join(` ... L176: `),"Review your stack"),await g()==="generate")return v;let i=OX(r,v),u=await $(i);if(!u)continue;let I=i.find((U)=>U.id===u);if(!I)continue;if(I.kind==="gate")v=EX(r,v,u);else{let... L177: `),`Recommended ${g.title} settings`)}let b=await $v({id:g.id,type:"select",message:`${g.title} — how to proceed?`,options:U,allowOther:!1},v.answers);v=Ar(v,g.id,b),I=n1(b)}if(I==... L178: `)}];var dN={id:"tailwind",title:"Tailwind CSS",category:"styling",appliesTo:(r)=>r.stylingLibrary==="tailwind",questions:()=>[{id:"tailwind.config",type:"select",summary:"Config s...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L171

161`)})}let z=r.documentation;if(Array.isArray(z)&&z.length){let V=z.map((H)=>nX[H]??`- Maintain ${H} documentation.`);v.push({title:"Documentation",body:V.join(` L162: `)})}let N=Jr(r,"logger"),j=N==="centralized"?"- Build one simple centralized logger module (a thin wrapper over the stdlib output) and import it everywhere; no third-party logging... L163: `)});let k=r.testTypes,G=["- Keep a separate testing setup: dedicated test config and directory layout; use fixtures/factories."];if(Array.isArray(k)&&k.length)G.unshift(`- Test ty... ... L171: `)+` L172: `}var W_={id:"cursor",displayName:"Cursor",knownArtifacts:[".cursorrules",".cursor/rules"],generate:(r)=>[{path:".cursorrules",content:vr("Cursor Rules",r.sections)}],agent:{binary... L173: `),I=v.map((b)=>`- ${b}: one of [${ab(b,g).join(", ")}]`).join(` ... L176: `),"Review your stack"),await g()==="generate")return v;let i=OX(r,v),u=await $(i);if(!u)continue;let I=i.find((U)=>U.id===u);if(!I)continue;if(I.kind==="gate")v=EX(r,v,u);else{let... L177: `),`Recommended ${g.title} settings`)}let b=await $v({id:g.id,type:"select",message:`${g.title} — how to proceed?`,options:U,allowOther:!1},v.answers);v=Ar(v,g.id,b),I=n1(b)}if(I

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L161

83${I} L84: `}}}}).prompt();import dv from"fs";import BW from"path";import{randomUUID as AW}from"crypto";var Gr={};xr(Gr,{xor:()=>VD,xid:()=>d0,void:()=>LD,uuidv7:()=>l0,uuidv6:()=>R0,uuidv4:(... L85: `)}var Q$=(r)=>(v,n,g,$)=>{let i=g?{...g,async:!1}:{async:!1},u=v._zod.run({value:n,issues:[]},i);if(u instanceof Promise)throw new Mr;if(u.issues.length){let I=new($?.Err??r)(u.is...

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/index.jsView on unpkg · L83

Findings

3 High2 Medium5 Low

HighChild Processdist/index.js

HighSame File Env Network Executiondist/index.js

HighCommand Output Exfiltrationdist/index.js

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowEvaldist/index.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

dist/index.jsView file

Lines 63-103javascript

65`):n.write(`${lr} ${k}

67`)?r.split(`

68`).map((n)=>v(n)).join(`

70`:""}${i}

71`;switch(this.state){case"submit":{let I=n?`${W("gray",B)} `:"",U=pr(r.output,v(this.options[this.cursor],"selected"),I);return`${u}${U}`}case"cancel":{let

72${W("gray",B)}`:""}`}default:{let I=n?`${W("cyan",B)} `:"",U=n?W("cyan",er):"",b=u.split(`

73`).length,D=n?2:1;return`${u}${I}${lg({output:r.output,cursor:this.cursor,options:this.options,maxItems:r.maxItems,columnPadding:I.length,rowPadding:b+D,style:(z,N)=>

74${I}`)}

75${U}

77`:""}${_n(this.state)} `}${r.message}

79${I}${$}

80${U}${u}

81`}case"submit":{let u=i?` ${W("dim",i)}`:"",I=v?W("gray",B):"";return`${n}${I}${u}`}case"cancel":{let u=i?` ${

82${I}`:""}`}default:{let u=v?`${W("cyan",B)} `:"",I=v?W("cyan",er):"";return`${n}${u}${$}

83${I}

84`}}}}).prompt();import dv from"fs";import BW from"path";import{randomUUID as AW}from"crypto";var Gr={};xr(Gr,{xor:()=>VD,xid:()=>d0,void:()=>LD,uuidv7:()=>l0,uuidv6:()=>R0,uuidv4

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/index.jsView on unpkg · L83

86`).filter((i)=>i),g=Math.min(...n.map((i)=>i.length-i.trimStart().length)),$=n.map((i)=>i.slice(g)).map((i)=>" ".repeat(this.indent*2)

88 if (${S}.issues.length) {

89 if (${O} in input) {

90 payload.issues = payload.issues.concat(${S}.issues.map(iss => ({

91 ...iss,

92 path: iss.path ? [${O}, ...iss.path] : [${O}]

93 })));

94 }

95 }

97 if (${S}.value === undefined) {

98 if (${O} in input) {

99 newResult[${O}] = undefined;

100 }

101 } else {

102 newResult[${O}] = ${S}.value;

103 }

Long lines were clipped for display.

Lines 141-191javascript

141 }

142 } else {

143 newResult[${O}] = ${S}.value;

144 }

145

147

148Set the \`cycles\` parameter to \`"ref"\`