registry / @wayai/cli / 0.3.169
@wayai/cli@0.3.169
WayAI CLI — sync hub configuration between local files and the platform
AI Security Review
scanned 27d ago · by lpm-firewall-aiInspected source supports a clean verdict: installation does not trigger package code, and the agent skill setup is an explicit CLI action using the WayAI API. Static signals for process execution and networking correspond to CLI self-update and version checks; no malicious behavior was established.
Static reason
One or more suspicious static signals were detected.
Trigger
A user runs a CLI command; the admin skill installation occurs only when the user invokes that command.
Impact
No confirmed attack surface was established; package installation itself has no lifecycle hook, and the inspected agent-file writes are user-invoked first-party setup.
Mechanism
The command requests skill files from the configured WayAI API and writes them into detected agent harness skill directories. Background checks report available updates and do not install them.
AI rationale
Inspected source supports a clean verdict: installation does not trigger package code, and the agent skill setup is an explicit CLI action using the WayAI API. Static signals for process execution and networking correspond to CLI self-update and version checks; no malicious behavior was established.
Evidence
package.jsondist/index.js
Network endpoints1
api.wayai.pro
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest identifies a WayAI CLI for syncing hub configuration and exposes dist/index.js as its command entrypoint.
- The manifest has no install lifecycle hook; its scripts are build, development, typecheck, and test tasks.
- The referenced agent integration targets the WayAI and WayAI Admin skill locations under .claude, .opencode, and .agents.
- Admin skill installation runs as a CLI command, uses authenticated API access, and writes returned files into harness skill directories.
- The background check only reports that an admin skill update is available and directs the user to run the install command.
- The CLI's self-update command checks and installs a newer @wayai/cli release when explicitly run.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
4 flaggeddist/index.jsView file
18129});
L18130: import { execFileSync } from "child_process";
L18131: import * as fs3 from "fs";
High
51while (cursor < text.length) {
L52: while (cursor < text.length && !isBase64UrlChar(text[cursor])) cursor++;
L53: const headerStart = cursor;
...
L236: "use strict";
L237: CREDENTIAL_KEY_RE = /token|secret|credential|password|passwd|api[_-]?key|authorization|private[_-]?key|session[_-]?id|cookie|jwt/i;
L238: NUMERIC_CREDENTIAL_KEY_RE = /(?:password|passwd|pin|token|secret|credential|api[_-]?key|authorization|private[_-]?key|session[_-]?id|cookie|jwt)$/i;
...
L249: [/\bway_[A-Za-z0-9_-]{8,}/g, "way_[REDACTED]"],
L250: // wst_ single-use WebSocket tickets (same opaque base64url format).
L251: [/\bwst_[A-Za-z0-9_-]{8,}/g, "wst_[REDACTED]"],
...
L366: try {
L367: const __dirname2 = dirname(fileURLToPath(import.meta.url));
L368: const pkg2 = JSON.parse(readFileSync(join(__dirname2, "..", "
High
Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
dist/index.jsView on unpkg · L5119512package = @wayai/cli; repositoryIdentity = platform; dependency = @napi-rs/keyring
L19512: try {
L19513: const mod = await import("@napi-rs/keyring");
L19514: const Entry = mod.Entry;
Findings
5 High3 Medium4 Low
HighChild Processdist/index.js
HighShell
HighSandbox Evasion Gated Capabilitydist/index.js
HighCopied Package Dependency Bridgedist/index.js
HighRuntime Package Installdist/index.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @wayai/cli@0.3.169.
See all versions of @wayai/cli for other recorded verdicts.
- Review the evidence and your use of @wayai/cli@0.3.169 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.