bailian-cli-runtime@2.4.0
Runtime framework for bailian-cli (createCli, registry, args, output, pipeline). See https://www.npmjs.com/package/bailian-cli for usage.
AI Security Review
scanned 17d ago · by lpm-firewall-aiSource inspection confirms an automatically reachable updater path that can invoke agent skill setup, but does not establish broad control-surface mutation or another concrete attack. The shell command is fixed and package-aligned, so this warrants a warning rather than a block.
Decision evidence
public snapshot- The package exposes the bundled runtime as its main export.
- During ordinary command handling, a significant detected update can trigger the updater; after updating, the runtime invokes the fixed `bl skill update` command.
- The version check requests release metadata from the npm registry.
- The observed shell command is a fixed first-party CLI command, not a command assembled from environment values or command output.
- The source does not establish what files the skill update changes, so broader agent control-surface mutation is unconfirmed.
Source & flagged code
5 flaggedA single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/index.mjsView on unpkg · L1Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
dist/index.mjsFindings
Affected versions and remediation
This report applies to bailian-cli-runtime@2.4.0.
See all versions of bailian-cli-runtime for other recorded verdicts.
- Review the evidence and your use of bailian-cli-runtime@2.4.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.