aiblueprint-cli@1.4.108
AIBlueprint CLI for setting up AI coding configurations
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe CLI sends runtime error telemetry containing identifying local details, including the home directory, without disclosure found in the reviewed README. This is a privacy risk, but the observed behavior is limited to error reporting and does not establish credential theft or a malicious install hook.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A user runs a CLI command that reaches a caught error, such as a failed setup.
Impact
The report can reveal the user’s local home path and details useful for identifying their environment.
Mechanism
The CLI posts the error message, stack, home directory, shell, locale, and system details to codelynx.dev. An environment variable can disable telemetry.
AI rationale
The CLI sends runtime error telemetry containing identifying local details, including the home directory, without disclosure found in the reviewed README. This is a privacy risk, but the observed behavior is limited to error reporting and does not establish credential theft or a malicious install hook.
Evidence
dist/cli.js
Network endpoints1
codelynx.dev
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The CLI posts telemetry to https://codelynx.dev/api/cli/events; collection is disabled only when AIBLUEPRINT_TELEMETRY_DISABLED=1.
- Error telemetry includes the error message and stack, plus system details including the home directory, shell, and locale.
- The setup error handler sends and flushes this telemetry automatically when setup fails.
Evidence against
- The error telemetry runs in CLI error handling, not an install lifecycle hook.
- The statusline’s Claude token request is directed to api.anthropic.com for usage limits.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
WildcardDependency
Source & flagged code
11 flaggeddist/cli.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = aiblueprint-cli@1.4.96
matchedIdentity = npm:YWlibHVlcHJpbnQtY2xp:1.4.96
similarity = 0.981
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/cli.jsView on unpkg625var EventEmitter = __require("node:events").EventEmitter;
L626: var childProcess = __require("node:child_process");
L627: var path = __require("node:path");
High
1067}
L1068: const execArgv2 = process2.execArgv ?? [];
L1069: if (execArgv2.includes("-e") || execArgv2.includes("--eval") || execArgv2.includes("-p") || execArgv2.includes("--print")) {
High
Findings
1 Critical7 High6 Medium6 Low
CriticalPrevious Version Dangerous Deltadist/cli.js
HighChild Processdist/cli.js
HighShelldist/cli.js
HighSame File Env Network Executiondist/cli.js
HighSandbox Evasion Gated Capabilityagents-config/claude-config/scripts/statusline/src/lib/features/limits/index.ts
HighTrigger Reachable Persistencedist/cli.js
HighRuntime Package Installdist/cli.js
HighSemantic Analysis Limitedagents-config/skills/skill-manager/scripts/inspect-description.ts
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/cli.js
MediumShips Build Helperagents-config/skills/apex/scripts/setup-templates.sh
Affected versions and remediation
This report applies to aiblueprint-cli@1.4.108.
See all versions of aiblueprint-cli for other recorded verdicts.
- Review the evidence and your use of aiblueprint-cli@1.4.108 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.