registry / @wayai/cli / 0.3.150
@wayai/cli@0.3.150
WayAI CLI — sync hub configuration between local files and the platform
AI Security Review
scanned 27d ago · by lpm-firewall-aiThe automatic, guarded project skill-link repair is an agent extension setup capability, so this warrants a warning under the agent integration policy. The package has no install hook, and the inspected behavior is limited to linking its existing WayAI skill.
Static reason
One or more suspicious static signals were detected.
Trigger
A user runs a non-help WayAI CLI command in a project with the WayAI skill under .agents/skills.
Impact
Claude Code can load the already-installed WayAI skill through the added link. No broader agent configuration mutation or confirmed attack was established.
Mechanism
The CLI checks for the skill file, then creates .claude/skills/wayai as a symlink to the existing skill; it replaces an existing entry only if that entry is itself a symlink.
AI rationale
The automatic, guarded project skill-link repair is an agent extension setup capability, so this warrants a warning under the agent integration policy. The package has no install hook, and the inspected behavior is limited to linking its existing WayAI skill.
Evidence
dist/index.js
Decision evidence
public snapshotAI called this Suspicious at 89.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The package exposes a CLI entry point and has no install lifecycle hook.
- On a non-help CLI command, startup attempts to repair a project skill link.
- The repair runs only when the WayAI skill already exists under .agents and its Claude counterpart is missing.
- The repair creates a project-local .claude/skills/wayai symlink and only removes an existing symlink at that path.
- The bundle’s agent skill directories include .claude, .opencode, and .agents.
Evidence against
- The detected agent configuration change is limited to linking the package’s own existing WayAI skill into Claude Code; it does not install or update a plugin.
- No evidence inspected established credential exfiltration or destructive behavior.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
4 flaggeddist/index.jsView file
14617});
L14618: import { execFileSync } from "child_process";
L14619: import * as fs2 from "fs";
High
51while (cursor < text.length) {
L52: while (cursor < text.length && !isBase64UrlChar(text[cursor])) cursor++;
L53: const headerStart = cursor;
...
L236: "use strict";
L237: CREDENTIAL_KEY_RE = /token|secret|credential|password|passwd|api[_-]?key|authorization|private[_-]?key|session[_-]?id|cookie|jwt/i;
L238: NUMERIC_CREDENTIAL_KEY_RE = /(?:password|passwd|pin|token|secret|credential|api[_-]?key|authorization|private[_-]?key|session[_-]?id|cookie|jwt)$/i;
...
L249: [/\bway_[A-Za-z0-9_-]{8,}/g, "way_[REDACTED]"],
L250: // wst_ single-use WebSocket tickets (same opaque base64url format).
L251: [/\bwst_[A-Za-z0-9_-]{8,}/g, "wst_[REDACTED]"],
...
L366: try {
L367: const __dirname2 = dirname(fileURLToPath(import.meta.url));
L368: const pkg2 = JSON.parse(readFileSync(join(__dirname2, "..", "
High
Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
dist/index.jsView on unpkg · L5115766package = @wayai/cli; repositoryIdentity = platform; dependency = @napi-rs/keyring
L15766: try {
L15767: const mod = await import("@napi-rs/keyring");
L15768: const Entry = mod.Entry;
Findings
5 High3 Medium4 Low
HighChild Processdist/index.js
HighShell
HighSandbox Evasion Gated Capabilitydist/index.js
HighCopied Package Dependency Bridgedist/index.js
HighRuntime Package Installdist/index.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @wayai/cli@0.3.150.
See all versions of @wayai/cli for other recorded verdicts.
- Review the evidence and your use of @wayai/cli@0.3.150 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.