registry / @uge/payo / 1.2.0

@uge/payo@1.2.0

CLI tool to generate AI rules and skills for your project

AI Security Review

scanned 8d ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

One or more suspicious static signals were detected.

Trigger

User runs `payo` or `npx @uge/payo` and chooses generation options.

Impact

Can modify project-local AI guidance files and, for selected assistant backends, delegate writing to local AI agents with permissive flags.

Mechanism

interactive AI guidance generator and local assistant CLI launcher

Policy narrative

The package is an interactive CLI for creating AI assistant guidance. When invoked by the user it may write project-local agent config files and spawn installed assistant CLIs such as claude, codex, cursor-agent, copilot, or agy. Some spawned commands use permission-bypass flags, which is risky, but this is not delivered through npm lifecycle execution and is aligned with the documented purpose.

Rationale

Source inspection shows a documented, user-invoked AI guidance generator with risky agent-facing capabilities but no unconsented install-time mutation, credential harvesting, exfiltration, persistence, or package-owned remote command channel. Because it can launch local AI tools with permissive flags and write broad agent control files, warn rather than mark fully clean.

Evidence

package.jsondist/index.jsREADME.mdCLAUDE.md.claude/skills/**.cursorrules.cursor/rules/**.github/copilot-instructions.md.github/instructions/**AGENTS.md.agents/skills/**.windsurfrulesAI_RULES.md.payo/**bootstrap-prompt.md

Decision evidence

public snapshot

AI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

dist/index.js defines user-invoked CLI generation of AI assistant files: CLAUDE.md, .claude/skills, .cursor/rules, AGENTS.md, .agents/skills, .github/instructions.
dist/index.js spawns local assistant CLIs via child_process.spawn for selected tools.
Claude and Antigravity agent args include permission-bypass flags when the user selects AI generation.
dist/index.js reads existing project manifests and directory listings for stack detection.

Evidence against

package.json has no install/postinstall lifecycle hook; prepack is publish-time build only.
CLI writes are bounded to process.cwd() by pX refusing paths outside the project directory.
No package-owned network endpoint or exfiltration flow found; network mentions are README badges/images and external assistant CLIs.
README documents that the tool writes assistant guidance files and may drive locally installed AI CLIs.
Static generation falls back to templates and does not require remote code or package server contact.

Behavioral surface

Source

ChildProcessEnvironmentVarsEvalFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 476 KB of source, external domains: github.com, json-schema.org

Source & flagged code

4 flagged

dist/index.jsView file

Lines 63-103javascript

63`);d.length>1&&n.write(Nv.cursor.up(d.length-1)),n.write(Nv.cursor.to(0)),n.write(Nv.erase.down())},Z=(d)=>d.replace(/\.+$/,""),p=(d)=>{let ur=(performance.now()-d)/1000,qr=Math.floor(ur/60),mr=Math.floor(ur%60);return qr>0?`[${qr}m ${mr}s]`:`[${mr}s]`},rr=U.withGuide??vr.withGuide,Dv=(d="")=>{_=!0,D=mb({output:n}),k=Z(d),H=performance.now(),rr&&n.write(`${W("gray",o)}

64`);let ur=0,qr=0;y(),z=setInterval(()=>{if(b&&k===Q)return;A(),Q=k;let mr=s(i[ur]),vn;if(b)vn=`${mr} ${k}...`;else if(r==="timer")vn=`${mr} ${k} ${p(H)}`;else{let vj=".".repeat(Math.floor(qr)).slice(0,3);vn=`${mr} ${k}${vj}`}let $j=cr(vn,x,{hard:!0,trim:!1});n.write($j),ur=ur+1<i.length?ur+1:0,qr=qr<4?qr+0.125:0},u)},pr=(d="",ur=0,qr=!1)=>{if(!_)return;_=!1,clearInterval(z),A();let mr=ur===0?W("green",_n):ur===1?W("red",ab):W("red",sb);k=d??k,qr||(r==="timer"?n.write(`${mr} ${k} ${p(H)}

65`):n.write(`${mr} ${k}

66`)),V(),D()};return{start:Dv,stop:(d="")=>pr(d,0),message:(d="")=>{k=Z(d??k)},cancel:(d="")=>pr(d,1),error:(d="")=>pr(d,2),clear:()=>pr("",0,!0),get isCancelled(){return j}}},t3={light:T("─","-"),heavy:T("━","="),block:T("█","#")};var Dn=(r,v)=>r.includes(`

67`)?r.split(`

68`).map((n)=>v(n)).join(`

69`):v(r),N$=(r)=>{let v=(n,g)=>{let $=n.label??String(n.value);switch(g){case"disabled":return`${W("gray",zn)} ${Dn($,(i)=>W("gray",i))}${n.hint?` ${W("dim",`(${n.hint??"disabled"})`)}`:""}`;case"selected":return`${Dn($,(i)=>W("dim",i))}`;case"active":return`${W("green",lg)} ${$}${n.hint

70`:""}${i}

71`;switch(this.state){case"submit":{let I=n?`${W("gray",o)} `:"",U=ar(r.output,v(this.options[this.cursor],"selected"),I);return`${u}${U}`}case"cancel":{let

72${W("gray",o)}`:""}`}default:{let I=n?`${W("cyan",o)} `:"",U=n?W("cyan",sr):"",b=u.split(`

73`).length,D=n?2:1;return`${u}${I}${fg({output:r.output,cursor:this.cursor,options:this.options,maxItems:r.maxItems,columnPadding:I.length,rowPadding:b+D,style:(z,_)=>

74${I}`)}

75${U}

76`}}}}).prompt()};var h3=`${W("gray",o)} `;var Jn=(r)=>new mg({validate:r.validate,placeholder:r.placeholder,defaultValue:r.defaultValue,initialValue:r.initialValue,output:r.output,signal:r.signal,input:r.input,render(){let v=r?.withGuide??vr.withGuide,n=`${`${v?`${W("gray",o)}

77`:""}${Nn(this.state)} `}${r.message}

78`,g=r.placeholder?W("inverse",r.placeholder[0])+W("dim",r.placeholder.slice(1)):W(["inverse","hidden"],"_"),$=this.userInput?this.userInputWithCursor:g,i=this.value??"";switch(this.state){case"error":{

79${I}${$}

80${U}${u}

81`}case"submit":{let u=i?` ${W("dim",i)}`:"",I=v?W("gray",o):"";return`${n}${I}${u}`}case"cancel":{let u=i?` ${W([

82${I}`:""}`}default:{let u=v?`${W("cyan",o)} `:"",I=v?W("cyan",sr):"";return`${n}${u}${$}

83${I}

84`}}}}).prompt();import pv from"fs";import TW from"path";import{randomUUID as lW}from"crypto";var Qr={};Tr(Qr,{xor:()=>BD,xid:()=>nD,void:()=>OD,uuidv7:()=>d0,uuidv6:()=>y0,uuidv4:()

85`)}var O$=(r)=>(v,n,g,$)=>{let i=g?{...g,async:!1}:{async:!1},u=v._zod.run({value:n,issues:[]},i);if(u instanceof Promise)throw new or;if(u.issues.length){let I=new($?.Err??r)(u.issues.map((U)=>jr(U,i,e())));throw Wn(I,$?.callee),I}return u.value},Xn=O$(Kr),E$=(r)=>async(v,n,g,$)=>{let i=g?{...g,async:!0}:{async:!0},u=v._zod.run({value:n,issues:[]},i);if(u instanceof Promise)u=await u;if(u.issues.length){let I=new($?.Err??r)(u.issues.map((U)=>jr(U,i,e())));throw Wn(I,$?.callee),I}return u.value},Pn=E$(Kr),S$=(r)=>(v,n,g)=>{let $=g?{...g,async:!1}:{async:!1},i=v._zod.run({value:n,issues:[]},$); ...

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/index.jsView on unpkg · L83

86`).filter((i)=>i),g=Math.min(...n.map((i)=>i.length-i.trimStart().length)),$=n.map((i)=>i.slice(g)).map((i)=>" ".repeat(this.indent*2)

87`))}}var n4={major:4,minor:4,patch:3};var E=N("$ZodType",(r,v)=>{var n;r??(r={}),r._zod.def=v,r._zod.bag=r._zod.bag||{},r._zod.version=n4;let g=[...r._zod.def.checks??[]];if(r._zod.traits.has("$ZodCheck"))g.

88 if (${S}.issues.length) {

89 if (${O} in input) {

90 payload.issues = payload.issues.concat(${S}.issues.map(iss => ({

91 ...iss,

92 path: iss.path ? [${O}, ...iss.path] : [${O}]

93 })));

94 }

95 }

97 if (${S}.value === undefined) {

98 if (${O} in input) {

99 newResult[${O}] = undefined;

100 }

101 } else {

102 newResult[${O}] = ${S}.value;

103 }

Long lines were clipped for display.

Lines 147-197javascript

147

148Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.`)}for(let u of r.seen.entries()){let I=u[1];if(v===u[0]){i(u);continue}if(r.external){let b=r.external.registry.get(u[0

Source & flagged code

4 flagged · loading source

dist/index.jsView file

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L177

177`)} L178: ---`}var G_={id:"cursor",displayName:"Cursor",knownArtifacts:[".cursorrules",".cursor/rules"],generate:(r)=>[{path:".cursorrules",content:gr("Cursor Rules",r.sections)}],agent:{bin... L179: `),b=v.map((z)=>`- ${z}: one of [${gb(z,g).join(", ")}]`).join(` ... L182: `),"Review your stack"),await g()==="generate")return v;let i=xX(r,v),u=await $(i);if(!u)continue;let I=i.find((U)=>U.id===u);if(!I)continue;if(I.kind==="gate")v=mX(r,v,u);else{let... L183: `),`Recommended ${g.title} settings`)}let b=await vv({id:g.id,type:"select",message:`${g.title} — how to proceed?`,options:U,allowOther:!1},v.answers);v=dr(v,g.id,b),I=Db(b)}if(I==... L184: `)}];var sN={id:"tailwind",title:"Tailwind CSS",category:"styling",appliesTo:(r)=>r.stylingLibrary==="tailwind",questions:()=>[{id:"tailwind.config",type:"select",summary:"Config s...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L177

167`)});let s=[],m=Wr(r,"formatter");if(m)s.push(`- Formatter: ${m}`);let S=Wr(r,"linter");if(S)s.push(`- Linter: ${S}`);if(s.length)v.push({title:"Tooling",body:s.join(` L168: `)});let O=Wr(r,"gitWorkflow");if(O){let V=[`Follow the ${O} workflow.`,"- Maintain a comprehensive .gitignore (build output, dependencies, environment/secret files, OS/editor arti... L169: `)})}v.push(...Y_(r));let y=Object.keys(r).filter((V)=>V.includes(".")&&r[V]!==void 0&&r[V]!=="").map((V)=>`- ${jX(V)}: ${JX(r[V])}`);if(y.length)v.push({title:"Tech Details",body:... ... L177: `)} L178: ---`}var G_={id:"cursor",displayName:"Cursor",knownArtifacts:[".cursorrules",".cursor/rules"],generate:(r)=>[{path:".cursorrules",content:gr("Cursor Rules",r.sections)}],agent:{bin... L179: `),b=v.map((z)=>`- ${z}: one of [${gb(z,g).join(", ")}]`).join(` ... L182: `),"Review your stack"),await g()==="generate")return v;let i=xX(r,v),u=await $(i);if(!u)continue;let I=i.find((U)=>U.id===u);if(!I)continue;if(I.kind==="gate")v=mX(r,v,u);else{let... L183: `),`Recommended ${g.title} settings`)}let b=await vv({id:g.id,type:"select",message:`${g.title} — how to proceed?`,options:U,allowOther:!1},v.answers);v=dr(v,g.id,b),I=Db(

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L167

83${I} L84: `}}}}).prompt();import pv from"fs";import TW from"path";import{randomUUID as lW}from"crypto";var Qr={};Tr(Qr,{xor:()=>BD,xid:()=>nD,void:()=>OD,uuidv7:()=>d0,uuidv6:()=>y0,uuidv4:(... L85: `)}var O$=(r)=>(v,n,g,$)=>{let i=g?{...g,async:!1}:{async:!1},u=v._zod.run({value:n,issues:[]},i);if(u instanceof Promise)throw new or;if(u.issues.length){let I=new($?.Err??r)(u.is...

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/index.jsView on unpkg · L83

Findings

3 High2 Medium5 Low

HighChild Processdist/index.js

HighSame File Env Network Executiondist/index.js

HighCommand Output Exfiltrationdist/index.js

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowEvaldist/index.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

dist/index.jsView file

Lines 63-103javascript

65`):n.write(`${mr} ${k}

67`)?r.split(`

68`).map((n)=>v(n)).join(`

70`:""}${i}

71`;switch(this.state){case"submit":{let I=n?`${W("gray",o)} `:"",U=ar(r.output,v(this.options[this.cursor],"selected"),I);return`${u}${U}`}case"cancel":{let

72${W("gray",o)}`:""}`}default:{let I=n?`${W("cyan",o)} `:"",U=n?W("cyan",sr):"",b=u.split(`

73`).length,D=n?2:1;return`${u}${I}${fg({output:r.output,cursor:this.cursor,options:this.options,maxItems:r.maxItems,columnPadding:I.length,rowPadding:b+D,style:(z,_)=>

74${I}`)}

75${U}

77`:""}${Nn(this.state)} `}${r.message}

79${I}${$}

80${U}${u}

81`}case"submit":{let u=i?` ${W("dim",i)}`:"",I=v?W("gray",o):"";return`${n}${I}${u}`}case"cancel":{let u=i?` ${W([

82${I}`:""}`}default:{let u=v?`${W("cyan",o)} `:"",I=v?W("cyan",sr):"";return`${n}${u}${$}

83${I}

84`}}}}).prompt();import pv from"fs";import TW from"path";import{randomUUID as lW}from"crypto";var Qr={};Tr(Qr,{xor:()=>BD,xid:()=>nD,void:()=>OD,uuidv7:()=>d0,uuidv6:()=>y0,uuidv4:()

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/index.jsView on unpkg · L83

86`).filter((i)=>i),g=Math.min(...n.map((i)=>i.length-i.trimStart().length)),$=n.map((i)=>i.slice(g)).map((i)=>" ".repeat(this.indent*2)

88 if (${S}.issues.length) {

89 if (${O} in input) {

90 payload.issues = payload.issues.concat(${S}.issues.map(iss => ({

91 ...iss,

92 path: iss.path ? [${O}, ...iss.path] : [${O}]

93 })));

94 }

95 }

97 if (${S}.value === undefined) {

98 if (${O} in input) {

99 newResult[${O}] = undefined;

100 }

101 } else {

102 newResult[${O}] = ${S}.value;

103 }

Long lines were clipped for display.

Lines 147-197javascript

147