registry / artor-cli / 0.12.1

artor-cli@0.12.1

Artor CLI — version, publish, and preview your web prototypes.

AI Security Review

scanned 8d ago · by lpm-firewall-ai

No confirmed malicious attack surface was found. The package is a feature-rich Artor CLI with network, file-write, and child_process capabilities gated behind user-invoked commands.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Explicit runtime use of artor subcommands such as login, publish, skill sync, registry login, update, or install.

Impact

Can publish project artifacts or modify local config when the user requests those CLI operations; no evidence of covert credential harvesting or install-time execution.

Mechanism

Package-aligned CLI API calls and local project configuration writes.

Rationale

Scanner findings are explained by an authenticated publishing/admin CLI: credentials are read only for explicit commands and sent to Artor API endpoints, while local file and process operations implement documented build, publish, registry, and skill workflows. I found no lifecycle hook, hidden exfiltration endpoint, persistence, destructive install-time behavior, or unconsented AI-agent control-surface mutation.

Evidence

package.jsondist/index.js~/.artor/config.json.artor/skills.lock.json.claude/skills/org/*AGENTS.md.npmrc.env.local

Network endpoints4

dash.artor.appregistry.npmjs.org/github.com/artorapp/skill/tree/main/artorlocalhost:3000

Decision evidence

public snapshot

AI called this Clean at 89.0% confidence as Benign with medium false-positive risk.

Evidence for block

dist/index.js has user-invoked child_process use for project build/install, global update/install, and Artor skill/plugin install commands.
dist/index.js can write project files such as .npmrc, .env.local, .claude/skills/org/*, AGENTS.md, and ~/.artor/config.json when matching CLI commands run.
dist/index.js sends ARTOR_GITHUB_TOKEN or ARTOR_REGISTRY_TOKEN only in explicit skill add/registry add request bodies.

Evidence against

package.json has no install/postinstall lifecycle hooks; bin only maps artor to ./dist/index.js.
Network traffic is CLI-aligned to configured Artor API default https://dash.artor.app, plus public npm/GitHub skill installer URLs for explicit update/install paths.
API verbose logging redacts authorization/cookie/token/password/secret fields and token-like values.
No import-time execution beyond dispatching the invoked CLI command; dangerous actions are behind explicit subcommands/prompts.
Publish uploads current project artifact/source to /api/cli/publish, which matches the package purpose of publishing prototypes.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 1 file(s), 189 KB of source, external domains: claude.com, dash.artor.app, github.com, nodejs.org, registry.npmjs.org

Source & flagged code

5 flagged

dist/index.jsView file

Lines 16-56javascript

16 if (Array.isArray(value)) return value.map((v) => redactForLog(v, depth + 1));

17 if (value && typeof value === "object") {

18 const out = {};

19 for (const [k, v] of Object.entries(value)) {

20 out[k] = SECRET_KEY.test(k) ? PLACEHOLDER : redactForLog(v, depth + 1);

21 }

22 return out;

23 }

24 return value;

25}

26function redactHeaders(headers) {

27 const entries = headers instanceof Headers ? [...headers.entries()] : Object.entries(headers);

28 const out = {};

29 for (const [k, v] of entries) {

30 out[k] = SECRET_KEY.test(k) ? PLACEHOLDER : redactString(v);

31 }

32 return out;

33}

34function redactBody(body) {

35 if (body === void 0 || body === "") return "";

36 try {

37 return JSON.stringify(redactForLog(JSON.parse(body)));

38 } catch {

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/index.jsView on unpkg · L36

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg · L36

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L36

39 const scrubbed = redactString(body);

40 return scrubbed.length > 2048 ? `${scrubbed.slice(0, 2048)}\u2026 (${scrubbed.length} bytes)` : scrubbed;

41 }

42}

44// ../shared/src/cli-version.ts

45var STRICT_SEMVER = /^\d+\.\d+\.\d+$/;

46function triplet(v) {

47 const [a, b, c2] = v.split(".").map(Number);

48 return [a, b, c2];

49}

50function compareSemver(a, b) {

51 if (!STRICT_SEMVER.test(a) || !STRICT_SEMVER.test(b)) {

52 throw new Error(`compareSemver: non-semver input ${a} / ${b}`);

53 }

54 const [aMaj, aMin, aPat] = triplet(a);

55 const [bMaj, bMin, bPat] = triplet(b);

56 if (aMaj !== bMaj) return aMaj > bMaj ? 1 : -1;

Lines 486-526javascript

486 if (ans === "") return defaultYes;

487 return ans === "y" || ans === "yes";

488 } finally {

489 rl.close();

490 }

491}

492async function

Lines 5162-5202javascript

5162

5163// src/commands/update.ts

5164async function update(_args) {

5165 const roots = deriveGlobalRoots(process.execPath, process.platform, process.env);

5166 const kind = effectiveKind(classifyInstall(process.argv[1] ?? "", roots), isPackagedBuild

Source & flagged code

5 flagged · loading source

dist/index.jsView file

36try { L37: return JSON.stringify(redactForLog(JSON.parse(body))); L38: } catch { ... L115: try { L116: const raw = readFileSync(new URL("../package.json", import.meta.url), "utf8"); L117: return JSON.parse(raw); ... L142: const body = typeof init2.body === "string" ? redactBody(init2.body) : void 0; L143: process.stderr.write(`\x1B[2m\u2192 ${method} ${url}\x1B[0m L144: `); ... L193: try { L194: res = await fetch(url, { ...init2, headers }); L195: } catch {

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/index.jsView on unpkg · L36

36Trigger-reachable chain: manifest.bin -> dist/index.js L36: try { L37: return JSON.stringify(redactForLog(JSON.parse(body))); L38: } catch { ... L115: try { L116: const raw = readFileSync(new URL("../package.json", import.meta.url), "utf8"); L117: return JSON.parse(raw); ... L142: const body = typeof init2.body === "string" ? redactBody(init2.body) : void 0; L143: process.stderr.write(`\x1B[2m\u2192 ${method} ${url}\x1B[0m L144: `); ... L193: try { L194: res = await fetch(url, { ...init2, headers }); L195: } catch {

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg · L36

506// src/build.ts L507: import { spawnSync } from "node:child_process"; L508: function runBuild(cwd, pm) {

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L506

5182} L5183: process.stdout.write(`${plan.message} L5184: `); ... L5188: // src/commands/install.ts L5189: import { spawnSync as spawnSync4 } from "node:child_process"; L5190: ... L5192: var SKILL_REPO = "artorapp/skill"; L5193: var SKILL_SOURCE_URL = "https://github.[redacted]"; L5194: function installPlan(target, platform = process.platform) {

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L5182

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L36

Findings

2 Critical4 High3 Medium5 Low

CriticalCredential Exfiltrationdist/index.js

CriticalTrigger Reachable Dangerous Capabilitydist/index.js

HighChild Processdist/index.js

HighShell

HighCommand Output Exfiltrationdist/index.js

HighSandbox Evasion Gated Capabilitydist/index.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

5 flagged

dist/index.jsView file

Lines 16-56javascript

16 if (Array.isArray(value)) return value.map((v) => redactForLog(v, depth + 1));

17 if (value && typeof value === "object") {

18 const out = {};

19 for (const [k, v] of Object.entries(value)) {

20 out[k] = SECRET_KEY.test(k) ? PLACEHOLDER : redactForLog(v, depth + 1);

21 }

22 return out;

23 }

24 return value;

25}

26function redactHeaders(headers) {

27 const entries = headers instanceof Headers ? [...headers.entries()] : Object.entries(headers);

28 const out = {};

29 for (const [k, v] of entries) {

30 out[k] = SECRET_KEY.test(k) ? PLACEHOLDER : redactString(v);

31 }

32 return out;

33}

34function redactBody(body) {

35 if (body === void 0 || body === "") return "";

36 try {

37 return JSON.stringify(redactForLog(JSON.parse(body)));

38 } catch {

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/index.jsView on unpkg · L36

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg · L36

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L36

39 const scrubbed = redactString(body);

40 return scrubbed.length > 2048 ? `${scrubbed.slice(0, 2048)}\u2026 (${scrubbed.length} bytes)` : scrubbed;

41 }

42}

44// ../shared/src/cli-version.ts

45var STRICT_SEMVER = /^\d+\.\d+\.\d+$/;

46function triplet(v) {

47 const [a, b, c2] = v.split(".").map(Number);

48 return [a, b, c2];

49}

50function compareSemver(a, b) {

51 if (!STRICT_SEMVER.test(a) || !STRICT_SEMVER.test(b)) {

52 throw new Error(`compareSemver: non-semver input ${a} / ${b}`);

53 }

54 const [aMaj, aMin, aPat] = triplet(a);

55 const [bMaj, bMin, bPat] = triplet(b);

56 if (aMaj !== bMaj) return aMaj > bMaj ? 1 : -1;

Lines 486-526javascript

486 if (ans === "") return defaultYes;

487 return ans === "y" || ans === "yes";

488 } finally {

489 rl.close();

490 }

491}

492async function

Lines 5162-5202javascript

5162

5163// src/commands/update.ts

5164async function update(_args) {

5165 const roots = deriveGlobalRoots(process.execPath, process.platform, process.env);

5166 const kind = effectiveKind(classifyInstall(process.argv[1] ?? "", roots), isPackagedBuild