registry / artor-cli / 0.17.0

artor-cli@0.17.0

Artor CLI — version, publish, and preview your web prototypes.

AI Security Review

scanned 13m ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. No confirmed malicious install-time behavior was found. The notable risk is explicit user-command setup/sync of Artor skills into local AI-agent skill locations.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

User runs `artor skill sync`, `artor install-claude-plugin`, `artor install-skills`, registry/login/publish commands, or auto-update prompts.

Impact

Potential AI-agent extension lifecycle risk if a user/org intentionally syncs untrusted Artor skills; no unconsented npm lifecycle mutation or credential exfiltration was confirmed.

Mechanism

Authenticated Artor CLI operations, project packaging, explicit agent-skill installation/sync, and prompted/manual npm update flows.

Rationale

Static inspection does not support the scanner's malicious credential-exfiltration label; observed token use is normal bearer authentication to Artor endpoints and optional user-provided registry/GitHub credentials. Because the package includes explicit AI-agent skill installation/sync capability, warn rather than block.

Evidence

package.jsondist/index.jsREADME.md~/.artor/config.json.artor/project.json.artor/skills.lock.json.claude/skills/org/*AGENTS.md.npmrcartor-server.mjsnext.config.mjs

Network endpoints3

dash.artor.appregistry.npmjs.org/github.com/artorapp/skill/tree/main/artor

Decision evidence

public snapshot

AI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

dist/index.js:1387-1681 implements explicit `artor skill sync` that writes `.claude/skills/org/*` and `AGENTS.md`.
dist/index.js:6497-6654 implements explicit `artor install-claude-plugin`/`install-skills` that runs `claude` or `npx` installers.
dist/index.js:253 and 2016 write tokens/config to `~/.artor/config.json` and project `.npmrc` during login/registry commands.

Evidence against

package.json has no preinstall/install/postinstall lifecycle scripts; only `bin` points to `dist/index.js`.
dist/index.js network calls target Artor APIs (`https://dash.artor.app`) or npm/GitHub URLs and are tied to user-invoked CLI commands.
dist/index.js:1280-1307 excludes `.claude`, `.artor`, `.env`, `.npmrc`, credentials, keys, and similar secrets from packaged source uploads.
dist/index.js:8-34 redacts tokens/secrets in verbose logs instead of exposing them.
dist/index.js:581-600 validates spawned binary names/args before shelling out.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 1 file(s), 230 KB of source, external domains: claude.com, dash.artor.app, github.com, nodejs.org, registry.npmjs.org

Source & flagged code

3 flagged

dist/index.jsView file

Lines 16-56javascript

16 if (Array.isArray(value)) return value.map((v) => redactForLog(v, depth + 1));

17 if (value && typeof value === "object") {

18 const out = {};

19 for (const [k, v] of Object.entries(value)) {

20 out[k] = SECRET_KEY.test(k) ? PLACEHOLDER : redactForLog(v, depth + 1);

21 }

22 return out;

23 }

24 return value;

25}

26function redactHeaders(headers) {

27 const entries = headers instanceof Headers ? [...headers.entries()] : Object.entries(headers);

28 const out = {};

29 for (const [k, v] of entries) {

30 out[k] = SECRET_KEY.test(k) ? PLACEHOLDER : redactString(v);

31 }

32 return out;

33}

34function redactBody(body) {

35 if (body === void 0 || body === "") return "";

36 try {

37 return JSON.stringify(redactForLog(JSON.parse(body)));

38 } catch {

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/index.jsView on unpkg · L36

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg · L36

39 const scrubbed = redactString(body);

40 return scrubbed.length > 2048 ? `${scrubbed.slice(0, 2048)}\u2026 (${scrubbed.length} bytes)` : scrubbed;

41 }

42}

44// ../shared/src/cli-version.ts

45var STRICT_SEMVER = /^\d+\.\d+\.\d+$/;

46function triplet(v) {

47 const [a, b, c2] = v.split(".").map(Number);

48 return [a, b, c2];

49}

50function compareSemver(a, b) {

51 if (!STRICT_SEMVER.test(a) || !STRICT_SEMVER.test(b)) {

52 throw new Error(`compareSemver: non-semver input ${a} / ${b}`);

53 }

54 const [aMaj, aMin, aPat] = triplet(a);

55 const [bMaj, bMin, bPat] = triplet(b);

56 if (aMaj !== bMaj) return aMaj > bMaj ? 1 : -1;

Lines 672-712javascript

672 }

673}

674function renderServerLauncher(spec) {

675 assertSafeSpecValue(spec.buildPath);

676 if (spec.kind === "serve-wrapper") assertSafeSpecValue(spec.servePackage);

677 switch (spec.kind) {

678 case "nitro-import":

679 return

Source & flagged code

3 flagged · loading source

dist/index.jsView file

36try { L37: return JSON.stringify(redactForLog(JSON.parse(body))); L38: } catch { ... L104: function registryUrl(pkg) { L105: return `https://registry.npmjs.org/${pkg.replace("/", "%2F")}/latest`; L106: } ... L123: try { L124: const raw = readFileSync(new URL("../package.json", import.meta.url), "utf8"); L125: return JSON.parse(raw); ... L150: const body = typeof init2.body === "string" ? redactBody(init2.body) : void 0; L151: process.stderr.write(`\x1B[2m\u2192 ${method} ${url}\x1B[0m L152: `);

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/index.jsView on unpkg · L36

36Trigger-reachable chain: manifest.bin -> dist/index.js L36: try { L37: return JSON.stringify(redactForLog(JSON.parse(body))); L38: } catch { ... L104: function registryUrl(pkg) { L105: return `https://registry.npmjs.org/${pkg.replace("/", "%2F")}/latest`; L106: } ... L123: try { L124: const raw = readFileSync(new URL("../package.json", import.meta.url), "utf8"); L125: return JSON.parse(raw); ... L150: const body = typeof init2.body === "string" ? redactBody(init2.body) : void 0; L151: process.stderr.write(`\x1B[2m\u2192 ${method} ${url}\x1B[0m L152: `);

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg · L36

692L693: await import(pathToFileURL(resolve(here, ${JSON.stringify(spec.buildPath)})).href); L694: `;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L692

Findings

2 Critical4 Medium5 Low

CriticalCredential Exfiltrationdist/index.js

CriticalTrigger Reachable Dangerous Capabilitydist/index.js

MediumDynamic Requiredist/index.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

3 flagged

dist/index.jsView file

Lines 16-56javascript

16 if (Array.isArray(value)) return value.map((v) => redactForLog(v, depth + 1));

17 if (value && typeof value === "object") {

18 const out = {};

19 for (const [k, v] of Object.entries(value)) {

20 out[k] = SECRET_KEY.test(k) ? PLACEHOLDER : redactForLog(v, depth + 1);

21 }

22 return out;

23 }

24 return value;

25}

26function redactHeaders(headers) {

27 const entries = headers instanceof Headers ? [...headers.entries()] : Object.entries(headers);

28 const out = {};

29 for (const [k, v] of entries) {

30 out[k] = SECRET_KEY.test(k) ? PLACEHOLDER : redactString(v);

31 }

32 return out;

33}

34function redactBody(body) {

35 if (body === void 0 || body === "") return "";

36 try {

37 return JSON.stringify(redactForLog(JSON.parse(body)));

38 } catch {

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/index.jsView on unpkg · L36

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg · L36

39 const scrubbed = redactString(body);

40 return scrubbed.length > 2048 ? `${scrubbed.slice(0, 2048)}\u2026 (${scrubbed.length} bytes)` : scrubbed;

41 }

42}

44// ../shared/src/cli-version.ts

45var STRICT_SEMVER = /^\d+\.\d+\.\d+$/;

46function triplet(v) {

47 const [a, b, c2] = v.split(".").map(Number);

48 return [a, b, c2];

49}

50function compareSemver(a, b) {

51 if (!STRICT_SEMVER.test(a) || !STRICT_SEMVER.test(b)) {

52 throw new Error(`compareSemver: non-semver input ${a} / ${b}`);

53 }

54 const [aMaj, aMin, aPat] = triplet(a);

55 const [bMaj, bMin, bPat] = triplet(b);

56 if (aMaj !== bMaj) return aMaj > bMaj ? 1 : -1;

Lines 672-712javascript

672 }

673}

674function renderServerLauncher(spec) {

675 assertSafeSpecValue(spec.buildPath);

676 if (spec.kind === "serve-wrapper") assertSafeSpecValue(spec.servePackage);

677 switch (spec.kind) {

678 case "nitro-import":

679 return