registry / @withone/cli / 2.8.0
@withone/cli@2.8.0
CLI for managing One
AI Security Review
scanned 19d ago · by lpm-firewall-aiSource inspection found no concrete attack behavior. The flagged agent configuration and credential handling are tied to user-invoked setup, and the prepare hook only runs the package build.
Static reason
One or more suspicious static signals were detected.
Trigger
The package build runs during prepare; agent setup and custom endpoint configuration require user-invoked CLI actions.
Impact
No confirmed attack surface or unauthorized effect was established.
Mechanism
The inspected code defines a build-only prepare script, configures the One MCP entry for supported agents, prompts for a key matching the user-entered custom endpoint, and starts pgserve for local storage.
AI rationale
Source inspection found no concrete attack behavior. The flagged agent configuration and credential handling are tied to user-invoked setup, and the prepare hook only runs the package build.
Evidence
package.jsondist/index.jsdist/chunk-UP2L4XJH.jsdist/chunk-NOPTG4GC.js
Decision evidence
public snapshotAI called this Clean at 89.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json defines prepare as a tsup build command.
- MCP configuration paths are defined for supported agents; the setup updates the One server entry in an existing configuration.
- The flagged skill paths are used by the explicit interactive `one init` command.
- A custom API key is prompted for the endpoint the user entered; no unrelated credential recipient is established.
- The flagged child-process code starts the bundled pgserve process for local memory storage.
Evidence against
- The inspected sources do not establish a concrete attack or an unconsented install-time agent configuration change.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsTelemetryUrlStrings
Source & flagged code
11 flaggeddist/chunk-NOPTG4GC.jsView file
1465import { createRequire } from "module";
L1466: import { spawn, spawnSync } from "child_process";
L1467: var requireFromHere = createRequire(import.meta.url);
High
Child Process
Package source references child process execution.
dist/chunk-NOPTG4GC.jsView on unpkg · L14651773patternName = generic_password
severity = medium
line = 1773
Medium
Secret Pattern
Package contains a possible secret pattern.
dist/chunk-NOPTG4GC.jsView on unpkg · L17731310if (this.backend) return this.backend;
L1311: const pg = await import("pg").catch((err) => {
L1312: const msg = err instanceof Error ? err.message : String(err);
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/chunk-NOPTG4GC.jsView on unpkg · L1310dist/index.js
Findings
6 High6 Medium9 Low
HighChild Processdist/chunk-NOPTG4GC.js
HighShelldist/index.js
HighCredential Redirect Persistencedist/index.js
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/index.js
HighCross File Remote Execution Contextdist/index.js
HighTrigger Reachable Persistencedist/index.js
MediumSecret Patterndist/chunk-NOPTG4GC.js
MediumDynamic Requiredist/chunk-NOPTG4GC.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/index.js
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
Affected versions and remediation
This report applies to @withone/cli@2.8.0.
See all versions of @withone/cli for other recorded verdicts.
- Review the evidence and your use of @withone/cli@2.8.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.