registry / @withone/cli
@withone/cli
CLI for managing One
This report shows the evidence for @withone/cli@2.11.0. 0 of 24 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe automatic refresh of an installed AI-agent skill is an unexpected control-surface update, so this merits a warning. The reviewed credential flow sends OpenAI keys to api.openai.com for embeddings, and the skill update is limited to the package’s own extension; no malicious behavior was identified.
Static reason
One or more suspicious static signals were detected.
Trigger
A user runs a CLI command other than init or update while the skill is installed and its recorded version is stale.
Impact
The AI-facing skill instructions may change automatically; the inspected behavior is limited to this package’s own skill.
Mechanism
The pre-action hook copies the packaged skill into the canonical agent skill directory without a separate skill-update request.
AI rationale
The automatic refresh of an installed AI-agent skill is an unexpected control-surface update, so this merits a warning. The reviewed credential flow sends OpenAI keys to api.openai.com for embeddings, and the skill update is limited to the package’s own extension; no malicious behavior was identified.
Evidence
dist/index.jsskills/one/SKILL.md~/.agents/skills/one/~/.agents/skills/one/.one-cli-version
Decision evidence
public snapshotAI called this Suspicious at 89.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- The CLI pre-action hook synchronizes the bundled skill on commands other than init and update.
- The sync runs only if the skill is already installed and its version marker is stale; it copies the packaged skill into the canonical agent skill directory.
- The bundled skill contains AI-facing instructions for using the One CLI.
- OpenAI keys are used for embeddings only when that provider is enabled, and the request sends the key to api.openai.com.
Evidence against
- The observed automatic write is limited to the package’s own skill, rather than broader agent settings.
- The inspected OpenAI credential flow targets OpenAI’s official embeddings endpoint.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsTelemetryUrlStrings
Source & flagged code
11 flaggeddist/chunk-NOPTG4GC.jsView file
1465import { createRequire } from "module";
L1466: import { spawn, spawnSync } from "child_process";
L1467: var requireFromHere = createRequire(import.meta.url);
High
Child Process
Package source references child process execution.
dist/chunk-NOPTG4GC.jsView on unpkg · L14651773patternName = generic_password
severity = medium
line = 1773
Medium
Secret Pattern
Package contains a possible secret pattern.
dist/chunk-NOPTG4GC.jsView on unpkg · L17731310if (this.backend) return this.backend;
L1311: const pg = await import("pg").catch((err) => {
L1312: const msg = err instanceof Error ? err.message : String(err);
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/chunk-NOPTG4GC.jsView on unpkg · L1310dist/chunk-5CPQHXTO.js
Findings
6 High6 Medium9 Low
HighChild Processdist/chunk-NOPTG4GC.js
HighShelldist/chunk-5CPQHXTO.js
HighCredential Redirect Persistencedist/index.js
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/index.js
HighCross File Remote Execution Contextdist/index.js
HighTrigger Reachable Persistencedist/index.js
MediumSecret Patterndist/chunk-NOPTG4GC.js
MediumDynamic Requiredist/chunk-NOPTG4GC.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/index.js
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
Affected versions and remediation
This report applies to @withone/cli@2.11.0.
The versions list below shows the verdict for each recorded version.
- Review the evidence and your use of @withone/cli@2.11.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.