registry / @wirecat/max-cli / 0.97.0
@wirecat/max-cli@0.97.0
MAX Messenger bots through the official Bot API, and a personal MAX account, from the terminal — built for agents and scripts
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe lifecycle hook is gated to global installs, and agent skill writes require an explicit setting or CLI command. The inspected credential flow reads a provider key for its configured endpoint; the scanner leads did not establish an attack chain.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Global npm install runs the postinstall helper; agent skill installation runs when the user invokes the CLI command.
Impact
No unauthorized data collection, credential redirection, or agent-control change was established.
Mechanism
The install helper limits agent skill writes to an explicit environment setting; the inspected API-key flow uses provider or configured endpoints.
AI rationale
The lifecycle hook is gated to global installs, and agent skill writes require an explicit setting or CLI command. The inspected credential flow reads a provider key for its configured endpoint; the scanner leads did not establish an attack chain.
Evidence
~/.claude/skills/<appName>/~/.agents/skills/<appName>/
Network endpoints2
api.anthropic.comapi.openai.com
Decision evidence
public snapshotAI called this Clean at 84.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package exposes a CLI; its postinstall hook runs its helper only for global npm installs.
- The global-install helper gates agent-folder writes on an explicit MAX_INSTALL_AGENT value and describes the Windows change as a user PATH update.
- The inspected API-key flow reads a configured provider key and uses the OpenAI or Anthropic endpoint, or a configured endpoint.
- Agent skill installation is a named CLI command that writes the tool's instructions to documented skill directories.
Evidence against
- The manifest defines postinstall and prepare lifecycle scripts.
- The CLI includes child-process functionality for its operational features.
- A scanner flagged remote decoding/execution and hidden-character concerns; the reviewed excerpts did not establish harmful behavior.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkWebSocket
Source & flagged code
17 flaggedpackage.jsonView file
•scripts.postinstall = node install/postinstall.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node install/postinstall.mjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/online.jsView file
1import { spawn } from "node:child_process";
L2: import { createInterface } from "node:readline";
High
Findings
4 Critical9 High7 Medium6 Low
CriticalRemote Asset Decode Executedist/bundle/program-6AJAZ3PL.js
CriticalTrojan Source Unicodedist/bundle/chunk-PFSM4HD7.js
CriticalTrigger Reachable Dangerous Capabilitydist/bundle/program-6AJAZ3PL.js
CriticalPrevious Version Dangerous Deltadist/bundle/chunk-F6ZYS24W.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/online.js
HighSame File Env Network Executiondist/bundle/program-6AJAZ3PL.js
HighCredential Redirect Persistencedist/bundle/program-6AJAZ3PL.js
HighSandbox Evasion Gated Capabilitydist/bundle/program-6AJAZ3PL.js
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/bundle/chunk-OJKVLKTC.js
Affected versions and remediation
This report applies to @wirecat/max-cli@0.97.0.
See all versions of @wirecat/max-cli for other recorded verdicts.
- Review the evidence and your use of @wirecat/max-cli@0.97.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.