registry / @wayai/cli / 0.3.229
@wayai/cli@0.3.229
WayAI CLI — sync hub configuration between local files and the platform
AI Security Review
scanned 16d ago · by lpm-firewall-aiSource inspection found no lifecycle hook in package.json, and the inspected runtime behaviors are explicit CLI functions with product-aligned destinations. The scanner signals did not establish a concrete attack surface.
Static reason
One or more suspicious static signals were detected.
Trigger
User-invoked login or update commands; alternate API destinations require an explicit --api-url argument.
Impact
No confirmed credential theft, unauthorized agent configuration change, or automatic install-time execution was established.
Mechanism
Login stores authentication tokens in the OS keyring, and the update command installs a newer @wayai/cli release.
AI rationale
Source inspection found no lifecycle hook in package.json, and the inspected runtime behaviors are explicit CLI functions with product-aligned destinations. The scanner signals did not establish a concrete attack surface.
Decision evidence
public snapshotAI called this Clean at 86.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json declares no install lifecycle hooks; its scripts are build, development, typecheck, and test commands.
- The indicated agent path code defines WayAI skill locations under supported agent directories.
- Login defaults to the WayAI API; a different API URL must be supplied explicitly with --api-url.
- Browser login uses the configured AuthKit flow and stores returned tokens in the OS keyring.
- The npm install command appears inside the explicit update command after it checks for a newer release.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
7 flaggeddist/index.jsView file
16761});
L16762: import { execFileSync } from "child_process";
L16763: import * as fs3 from "fs";
High
8662"type": "string",
L8663: "description": "The Bash script to run, as with `bash -c`. It runs in /workspace unless it changes directory."
L8664: },
High
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/index.js:
CREDENTIAL_KEY_RE = /token|secret|credential|password|passwd|api[_-]?key|authorization|private[_-]?key|session[_-]?id|cookie|jwt/i;
NUMERIC_CREDENTIAL_KEY_RE = /(?:password|passwd|pin|token|secret|credential|api[_-]?key|authorization|private[_-]?key|session[_-]?id|cookie|jwt)$/i;
// Stripe API keys and webhook signing secrets. Keep this aligned with
// LLM provider API keys. The captured delimiter is deliberate: `_` may
[AUTH_TYPE.API_KEY]: "API Key",
"API Key": AUTH_TYPE.API_KEY,
SKILL_INSTALL_COMMAND = "mkdir -p .claude && npx skills add wayai-pro/wayai-skill -y";
external_exports.enum(["API Key", "Bearer Token", "Basi
Findings
6 High4 Medium4 Low
HighChild Processdist/index.js
HighShelldist/index.js
HighCredential Redirect Persistencedist/index.js
HighSandbox Evasion Gated Capabilitydist/index.js
HighObfuscated Payload Loaderdist/index.js
HighRuntime Package Installdist/index.js
MediumDynamic Requiredist/index.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @wayai/cli@0.3.229.
See all versions of @wayai/cli for other recorded verdicts.
- Review the evidence and your use of @wayai/cli@0.3.229 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.