registry / @withone/cli / 2.7.1
@withone/cli@2.7.1
CLI for managing One
AI Security Review
scanned 19d ago · by lpm-firewall-aiThe automatic refresh of installed agent instructions leaves a bounded first-party extension lifecycle risk, so a warning is appropriate. The inspected sources do not establish a concrete malicious attack.
Static reason
One or more suspicious static signals were detected.
Trigger
Running a CLI command other than init or update when the One skill is installed and its recorded version is stale.
Impact
Agent instructions can change as the package version changes; the inspected behavior does not establish credential theft or remote command execution.
Mechanism
The CLI copies the packaged skill into its canonical location, which selected agent skill directories link to.
AI rationale
The automatic refresh of installed agent instructions leaves a bounded first-party extension lifecycle risk, so a warning is appropriate. The inspected sources do not establish a concrete malicious attack.
Evidence
dist/index.jsskills/one/SKILL.md
Decision evidence
public snapshotAI called this Suspicious at 77.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The manifest's prepare hook runs the build tool; the agent-skill refresh is a separate runtime behavior.
- On ordinary commands, the CLI checks whether an installed skill is stale and copies the package's skill into its canonical location.
- The refresh only runs when the skill is already installed and its recorded version differs from the CLI version.
- The setup code links the canonical skill into selected agent skill directories, so refreshed instructions become visible to those agents.
- The bundled skill provides instructions for using the One CLI with third-party platforms.
Evidence against
- The inspected refresh path updates the package's own skill and does not establish credential transfer or remote command execution.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStrings
Source & flagged code
11 flaggeddist/chunk-NOPTG4GC.jsView file
1465import { createRequire } from "module";
L1466: import { spawn, spawnSync } from "child_process";
L1467: var requireFromHere = createRequire(import.meta.url);
High
Child Process
Package source references child process execution.
dist/chunk-NOPTG4GC.jsView on unpkg · L14651773patternName = generic_password
severity = medium
line = 1773
Medium
Secret Pattern
Package contains a possible secret pattern.
dist/chunk-NOPTG4GC.jsView on unpkg · L17731310if (this.backend) return this.backend;
L1311: const pg = await import("pg").catch((err) => {
L1312: const msg = err instanceof Error ? err.message : String(err);
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/chunk-NOPTG4GC.jsView on unpkg · L1310dist/index.js
Findings
6 High6 Medium9 Low
HighChild Processdist/chunk-NOPTG4GC.js
HighShelldist/index.js
HighCredential Redirect Persistencedist/index.js
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/index.js
HighCross File Remote Execution Contextdist/index.js
HighTrigger Reachable Persistencedist/index.js
MediumSecret Patterndist/chunk-NOPTG4GC.js
MediumDynamic Requiredist/chunk-NOPTG4GC.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/index.js
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
Affected versions and remediation
This report applies to @withone/cli@2.7.1.
See all versions of @withone/cli for other recorded verdicts.
- Review the evidence and your use of @withone/cli@2.7.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.