@velaro/cli@1.4.41
Velaro Workspace v20 — command-line interface for managing bots, knowledge base ingestion, MCP API keys, search indexes, and ops health.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe source establishes an explicit-user AI-agent configuration mutation, which warrants a warning. The install hook is limited to a banner path, and no automatic exfiltration or broad control-surface takeover was found.
Static reason
One or more suspicious static signals were detected.
Trigger
The user runs velaro mcp-key install.
Impact
Adds a third-party AI-agent capability to the user's configuration and causes later agent use to resolve and run the named MCP server.
Mechanism
Creates an MCP key and writes a Claude Code stdio server entry.
AI rationale
The source establishes an explicit-user AI-agent configuration mutation, which warrants a warning. The install hook is limited to a banner path, and no automatic exfiltration or broad control-surface takeover was found.
Evidence
lib/commands/mcp-key.js~/.claude.json
Network endpoints1
api-admin-us-east.velaro.com
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The package has an automatic postinstall hook.
- An explicit MCP-key command creates a key and rewrites the user's Claude Code configuration to launch a remote package through npx.
- The explicit update command runs a global npm install.
- A user-invoked screenshot feature obtains credentials from environment variables or Azure Key Vault and uploads captured content.
- Staff-only commands can change AI model settings through authenticated service requests.
Evidence against
- Postinstall only imports the banner function; it does not configure an AI agent or make a network request.
- The Claude Code configuration change requires the clearly named mcp-key install command.
- No self-dependency, obfuscated payload, credential exfiltration path, or automatic broad agent-control mutation was found.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkShell
HighEntropyStrings
Source & flagged code
9 flaggedpackage.jsonView file
•scripts.postinstall = node scripts/postinstall.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg•Remote tarball dependency specs: xlsx@https://cdn.sheetjs.com/xlsx-0.20.3/xlsx-0.20.3.tgz
Medium
Remote Tarball Dependency
Package manifest contains a dependency pinned to a remote tarball URL.
package.jsonView on unpkglib/kb-screenshot.jsView file
Findings
8 High5 Medium5 Low
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processlib/kb-screenshot.js
HighShell
HighSame File Env Network Executionlib/kb-screenshot.js
HighCommand Output Exfiltrationlib/commands/update.js
HighTrigger Reachable Command Output Exfiltrationlib/commands/update.js
HighRuntime Package Installlib/commands/update.js
HighSemantic Analysis Limitedlib/kb-screenshot.js#virtual:normalized:round1
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumRemote Tarball Dependency
Affected versions and remediation
This report applies to @velaro/cli@1.4.41.
See all versions of @velaro/cli for other recorded verdicts.
- Review the evidence and your use of @velaro/cli@1.4.41 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.