registry / artor-cli / 0.15.0

artor-cli@0.15.0

Artor CLI — version, publish, and preview your web prototypes.

AI Security Review

scanned 5d ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

User runs `artor skill sync`, `artor install`, `artor install-skills`, `artor install-claude-plugin`, `artor registry add/login`, or publish/init commands.

Impact

Can write project `.claude/skills/org/`, `AGENTS.md`, `.artor/*`, `.npmrc`, downloaded project/template files, and send user-supplied credentials to Artor API; no unconsented lifecycle mutation observed.

Mechanism

authenticated Artor CLI network operations and user-invoked agent skill/plugin installation

Policy narrative

The package is a broad Artor CLI. Risky behavior is reachable through explicit commands: authenticated API calls, packaging/publishing local projects with secret exclusions, writing local project config, syncing org skills into Claude's project skill directory, updating AGENTS.md, and launching external CLIs for Artor skill/plugin installation. I found no npm lifecycle execution, automatic import-time mutation, credential harvesting beyond user-supplied/authenticated CLI flows, or exfiltration to non-Artor endpoints.

Rationale

Source inspection does not support a malicious verdict: the network and credential paths are package-aligned, user-invoked CLI functionality, with no lifecycle hook or automatic foreign agent control-surface mutation. Because it can intentionally write Claude/agent skill surfaces from remote Artor-managed content, warn rather than block.

Evidence

package.jsondist/index.jsREADME.md~/.artor/config.json.artor/project.json.artor/skills.lock.json.claude/skills/org/<skill>/AGENTS.md.npmrcartor-server.mjsnext.config.mjs

Network endpoints5

dash.artor.appregistry.npmjs.org/github.com/artorapp/skill/tree/main/artorclaude.com/codenodejs.org

Decision evidence

public snapshot

AI called this Suspicious at 82.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

User-invoked `artor skill sync` downloads skill tarballs from Artor API and writes `.claude/skills/org/<name>/` plus an `AGENTS.md` managed block in `dist/index.js`.
User-invoked `artor install` can run `claude plugin marketplace add artorapp/skill`, `claude plugin install artor@artor`, or `npx -y skills@latest add https://github.com/artorapp/skill/tree/main/artor`.
`registry add` and `skill add` can send user-supplied/env credentials to package-aligned Artor API endpoints.
`maybeOfferGlobalInstall` may prompt interactive npx/local users to run `npm install -g artor-cli@latest`.

Evidence against

`package.json` has no install/postinstall lifecycle hook; `prepack` is publish-time only.
`dist/index.js` command dispatch requires explicit CLI subcommands; agent/plugin writes are not install-time behavior.
Verbose API logging redacts authorization, token, password, secret, credential, cookie, and token-like values.
Publish packaging excludes `.env*`, `.npmrc`, `.ssh`, `.claude`, `.artor`, cloud credential names, private keys, and escaping symlinks.
Child process helper validates binary and argument characters before spawning.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 1 file(s), 204 KB of source, external domains: claude.com, dash.artor.app, github.com, nodejs.org, registry.npmjs.org

Source & flagged code

3 flagged

dist/index.jsView file

Lines 16-56javascript

16 if (Array.isArray(value)) return value.map((v) => redactForLog(v, depth + 1));

17 if (value && typeof value === "object") {

18 const out = {};

19 for (const [k, v] of Object.entries(value)) {

20 out[k] = SECRET_KEY.test(k) ? PLACEHOLDER : redactForLog(v, depth + 1);

21 }

22 return out;

23 }

24 return value;

25}

26function redactHeaders(headers) {

27 const entries = headers instanceof Headers ? [...headers.entries()] : Object.entries(headers);

28 const out = {};

29 for (const [k, v] of entries) {

30 out[k] = SECRET_KEY.test(k) ? PLACEHOLDER : redactString(v);

31 }

32 return out;

33}

34function redactBody(body) {

35 if (body === void 0 || body === "") return "";

36 try {

37 return JSON.stringify(redactForLog(JSON.parse(body)));

38 } catch {

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/index.jsView on unpkg · L36

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg · L36

39 const scrubbed = redactString(body);

40 return scrubbed.length > 2048 ? `${scrubbed.slice(0, 2048)}\u2026 (${scrubbed.length} bytes)` : scrubbed;

41 }

42}

44// ../shared/src/cli-version.ts

45var STRICT_SEMVER = /^\d+\.\d+\.\d+$/;

46function triplet(v) {

47 const [a, b, c2] = v.split(".").map(Number);

48 return [a, b, c2];

49}

50function compareSemver(a, b) {

51 if (!STRICT_SEMVER.test(a) || !STRICT_SEMVER.test(b)) {

52 throw new Error(`compareSemver: non-semver input ${a} / ${b}`);

53 }

54 const [aMaj, aMin, aPat] = triplet(a);

55 const [bMaj, bMin, bPat] = triplet(b);

56 if (aMaj !== bMaj) return aMaj > bMaj ? 1 : -1;

Lines 639-679javascript

639 }

640}

641function renderServerLauncher(spec) {

642 assertSafeSpecValue(spec.buildPath);

643 if (spec.kind === "serve-wrapper") assertSafeSpecValue(spec.servePackage);

644 switch (spec.kind) {

645 case "nitro-import":

646 return

Source & flagged code

3 flagged · loading source

dist/index.jsView file

36try { L37: return JSON.stringify(redactForLog(JSON.parse(body))); L38: } catch { ... L127: try { L128: const raw = readFileSync(new URL("../package.json", import.meta.url), "utf8"); L129: return JSON.parse(raw); ... L154: const body = typeof init2.body === "string" ? redactBody(init2.body) : void 0; L155: process.stderr.write(`\x1B[2m\u2192 ${method} ${url}\x1B[0m L156: `); ... L205: try { L206: res = await fetch(url, { ...init2, headers }); L207: } catch {

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/index.jsView on unpkg · L36

36Trigger-reachable chain: manifest.bin -> dist/index.js L36: try { L37: return JSON.stringify(redactForLog(JSON.parse(body))); L38: } catch { ... L127: try { L128: const raw = readFileSync(new URL("../package.json", import.meta.url), "utf8"); L129: return JSON.parse(raw); ... L154: const body = typeof init2.body === "string" ? redactBody(init2.body) : void 0; L155: process.stderr.write(`\x1B[2m\u2192 ${method} ${url}\x1B[0m L156: `); ... L205: try { L206: res = await fetch(url, { ...init2, headers }); L207: } catch {

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg · L36

659L660: await import(pathToFileURL(resolve(here, ${JSON.stringify(spec.buildPath)})).href); L661: `;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L659

Findings

2 Critical4 Medium5 Low

CriticalCredential Exfiltrationdist/index.js

CriticalTrigger Reachable Dangerous Capabilitydist/index.js

MediumDynamic Requiredist/index.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

3 flagged

dist/index.jsView file

Lines 16-56javascript

16 if (Array.isArray(value)) return value.map((v) => redactForLog(v, depth + 1));

17 if (value && typeof value === "object") {

18 const out = {};

19 for (const [k, v] of Object.entries(value)) {

20 out[k] = SECRET_KEY.test(k) ? PLACEHOLDER : redactForLog(v, depth + 1);

21 }

22 return out;

23 }

24 return value;

25}

26function redactHeaders(headers) {

27 const entries = headers instanceof Headers ? [...headers.entries()] : Object.entries(headers);

28 const out = {};

29 for (const [k, v] of entries) {

30 out[k] = SECRET_KEY.test(k) ? PLACEHOLDER : redactString(v);

31 }

32 return out;

33}

34function redactBody(body) {

35 if (body === void 0 || body === "") return "";

36 try {

37 return JSON.stringify(redactForLog(JSON.parse(body)));

38 } catch {

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/index.jsView on unpkg · L36

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg · L36

39 const scrubbed = redactString(body);

40 return scrubbed.length > 2048 ? `${scrubbed.slice(0, 2048)}\u2026 (${scrubbed.length} bytes)` : scrubbed;

41 }

42}

44// ../shared/src/cli-version.ts

45var STRICT_SEMVER = /^\d+\.\d+\.\d+$/;

46function triplet(v) {

47 const [a, b, c2] = v.split(".").map(Number);

48 return [a, b, c2];

49}

50function compareSemver(a, b) {

51 if (!STRICT_SEMVER.test(a) || !STRICT_SEMVER.test(b)) {

52 throw new Error(`compareSemver: non-semver input ${a} / ${b}`);

53 }

54 const [aMaj, aMin, aPat] = triplet(a);

55 const [bMaj, bMin, bPat] = triplet(b);

56 if (aMaj !== bMaj) return aMaj > bMaj ? 1 : -1;

Lines 639-679javascript

639 }

640}

641function renderServerLauncher(spec) {

642 assertSafeSpecValue(spec.buildPath);

643 if (spec.kind === "serve-wrapper") assertSafeSpecValue(spec.servePackage);

644 switch (spec.kind) {

645 case "nitro-import":

646 return