@velaro/cli@1.4.40
Velaro Workspace v20 — command-line interface for managing bots, knowledge base ingestion, MCP API keys, search indexes, and ops health.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiNo concrete malicious install-time behavior, secret exfiltration, or stealth persistence was found. The explicit Claude configuration mutation and npx-based server launch remain a meaningful agent-capability risk under the policy.
Static reason
One or more suspicious static signals were detected.
Trigger
The user runs velaro mcp-key install, then Claude starts the configured MCP server.
Impact
The command grants a package-managed MCP server access to the newly created Velaro key when Claude launches it.
Mechanism
Writes a Claude MCP server definition that invokes npx for @velaro/mcp-server.
AI rationale
No concrete malicious install-time behavior, secret exfiltration, or stealth persistence was found. The explicit Claude configuration mutation and npx-based server launch remain a meaningful agent-capability risk under the policy.
Evidence
lib/commands/mcp-key.js~/.claude.json
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The explicit mcp-key install command creates a Claude MCP entry that launches npx with @velaro/mcp-server and a newly issued key.
- The package has a postinstall hook; its banner records a first-run flag in the Velaro configuration.
Evidence against
- Claude configuration is changed only by the named mcp-key install subcommand, not during installation.
- The postinstall code imports only the banner path; no network or agent-control write was found there.
- The update shell command is reachable only through the explicit update command.
- The screenshot helper uses supplied or operator credentials for a KB upload and cleans up its temporary images.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
8 flaggedpackage.jsonView file
•scripts.postinstall = node scripts/postinstall.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkglib/kb-screenshot.jsView file
19import { fileURLToPath } from 'url';
L20: import { execFile } from 'child_process';
L21: import { promisify } from 'util';
High
Child Process
Package source references child process execution.
lib/kb-screenshot.jsView on unpkg · L19Findings
8 High4 Medium5 Low
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processlib/kb-screenshot.js
HighShell
HighSame File Env Network Executionlib/kb-screenshot.js
HighCommand Output Exfiltrationlib/commands/update.js
HighTrigger Reachable Command Output Exfiltrationlib/commands/update.js
HighRuntime Package Installlib/commands/update.js
HighSemantic Analysis Limitedlib/kb-screenshot.js#virtual:normalized:round1
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
Affected versions and remediation
This report applies to @velaro/cli@1.4.40.
See all versions of @velaro/cli for other recorded verdicts.
- Review the evidence and your use of @velaro/cli@1.4.40 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.