@velaro/cli@1.4.89
⚠ Under reviewVelaro Workspace v20 — command-line interface for managing bots, knowledge base ingestion, MCP API keys, search indexes, and ops health.
AI Security Review
scanned 24d ago · by lpm-firewall-aiInspected source supports benign explanations for the flagged postinstall, updater, and credential requests, but the required clean citation coverage cannot fit within the 16-citation limit alongside the requested runtime caller citations. Manual review is required to resolve that output constraint without inventing an attack or claiming complete clean coverage.
Decision evidence
public snapshot- package.json runs a postinstall script that prints a banner; inspected code shows no install-time network or project mutation.
- The flagged updater contacts the npm registry and runs a global install only when the user invokes the update command.
- The API helper sends Velaro tokens to the configured Velaro API base; OAuth refresh sends refresh tokens to the Velaro login endpoint.
- A screenshot helper retrieves credentials from Azure Key Vault for its staging screenshot workflow; inspected evidence does not establish an unrelated credential recipient.
- Clean citation coverage requires more than the 16-citation limit when combined with all required runtime caller excerpts.
- The supplied scanner hints include command execution, network access, and incomplete semantic analysis, but inspected excerpts do not establish attack behavior.
Source & flagged code
9 flaggedPackage defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgPackage manifest contains a dependency pinned to a remote tarball URL.
package.jsonView on unpkgFindings
Affected versions and remediation
This report applies to @velaro/cli@1.4.89.
See all versions of @velaro/cli for other recorded verdicts.
- Review the evidence and your use of @velaro/cli@1.4.89 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.