registry / @withone/cli / 2.8.1
@withone/cli@2.8.1
CLI for managing One
AI Security Review
scanned 19d ago · by lpm-firewall-aiThe inspected findings are consistent with CLI setup and optional local database functionality. The package prepare hook runs a build, and the credential and agent-configuration behaviors reviewed do not establish a concrete attack.
Static reason
One or more suspicious static signals were detected.
Trigger
Agent configuration and API setup are reached through CLI actions; the package prepare hook runs a build.
Impact
No confirmed harmful effect was established from the inspected behavior.
Mechanism
The CLI supports writing its MCP configuration and validating an API key at the default or user-entered endpoint.
AI rationale
The inspected findings are consistent with CLI setup and optional local database functionality. The package prepare hook runs a build, and the credential and agent-configuration behaviors reviewed do not establish a concrete attack.
Network endpoints1
api.withone.ai
Decision evidence
public snapshotAI called this Clean at 87.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package exposes a CLI and its prepare hook runs a build command.
- The agent configuration helper writes an agent config file; the cited Claude Code entry identifies a config destination.
- The skill target is associated with the CLI’s skill installation flow.
- The CLI offers a default API endpoint or a custom endpoint entered by the user, then validates the supplied key against that endpoint.
- The child-process reference is in the embedded Postgres daemon component.
Evidence against
- The inspected sources do not show install-time credential forwarding or automatic agent configuration mutation. The API key is validated against the selected endpoint, and the agent configuration writes occur through CLI runtime paths.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStrings
Source & flagged code
11 flaggeddist/chunk-NOPTG4GC.jsView file
1465import { createRequire } from "module";
L1466: import { spawn, spawnSync } from "child_process";
L1467: var requireFromHere = createRequire(import.meta.url);
High
Child Process
Package source references child process execution.
dist/chunk-NOPTG4GC.jsView on unpkg · L14651773patternName = generic_password
severity = medium
line = 1773
Medium
Secret Pattern
Package contains a possible secret pattern.
dist/chunk-NOPTG4GC.jsView on unpkg · L17731310if (this.backend) return this.backend;
L1311: const pg = await import("pg").catch((err) => {
L1312: const msg = err instanceof Error ? err.message : String(err);
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/chunk-NOPTG4GC.jsView on unpkg · L1310dist/index.js
Findings
6 High6 Medium9 Low
HighChild Processdist/chunk-NOPTG4GC.js
HighShelldist/index.js
HighCredential Redirect Persistencedist/index.js
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/index.js
HighCross File Remote Execution Contextdist/index.js
HighTrigger Reachable Persistencedist/index.js
MediumSecret Patterndist/chunk-NOPTG4GC.js
MediumDynamic Requiredist/chunk-NOPTG4GC.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/index.js
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
Affected versions and remediation
This report applies to @withone/cli@2.8.1.
See all versions of @withone/cli for other recorded verdicts.
- Review the evidence and your use of @withone/cli@2.8.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.