@velaro/cli@1.4.145
Velaro Workspace v20 — command-line interface for managing bots, knowledge base ingestion, MCP API keys, search indexes, and ops health.
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe install hook only displays a banner, and the usage tracker’s top-level credential check does not match the configuration structure used by the package. The flagged network behavior therefore does not send under normal package configuration.
Decision evidence
public snapshot- The postinstall hook displays a version banner on the terminal; the reviewed code shows no install-time network activity.
- Normal configuration stores credentials inside an envs object, while readConfig returns that configuration wrapper.
- The usage tracker looks for credentials at the wrapper’s top level and returns without sending a request when they are absent; the normal config shape therefore prevents the flagged telemetry from sending.
Source & flagged code
10 flaggedPackage defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgPackage manifest contains a dependency pinned to a remote tarball URL.
package.jsonView on unpkgFindings
Affected versions and remediation
This report applies to @velaro/cli@1.4.145.
See all versions of @velaro/cli for other recorded verdicts.
- Review the evidence and your use of @velaro/cli@1.4.145 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.