cyrus-ai
AI-powered Linear issue automation using Claude
This report shows the evidence for cyrus-ai@0.2.75. 0 of 6 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 1d ago · by lpm-firewall-aiThe credential-exfiltration hint is a false alarm: the flagged code performs an explicit Linear OAuth flow and sends credentials to Linear. However, startup enables undocumented Sentry error and log reporting for configured installations, so this is suspicious telemetry rather than clean.
Static reason
No blocking static signals were detected.
Trigger
CLI startup when CYRUS_TEAM_ID is set and CYRUS_SENTRY_DISABLED is not enabled.
Impact
Operational details in logs or error context may be disclosed to the package publisher’s Sentry project.
Mechanism
The CLI initializes Sentry at bootstrap and captures errors and console output; a scrubber removes common credential fields and token-like strings.
AI rationale
The credential-exfiltration hint is a false alarm: the flagged code performs an explicit Linear OAuth flow and sends credentials to Linear. However, startup enables undocumented Sentry error and log reporting for configured installations, so this is suspicious telemetry rather than clean.
Evidence
dist/src/app.jsdist/src/services/createErrorReporter.jsdist/src/services/SentryErrorReporter.jsdist/src/services/sentryScrubber.js
Network endpoints2
o4509685010399232.ingest.us.sentry.ioapi.linear.app
Decision evidence
public snapshotAI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The CLI initializes a process-wide error reporter at startup, before parsing the command.
- The reporter uses a baked-in Sentry endpoint when enabled; it stays inactive without CYRUS_TEAM_ID and can be disabled with CYRUS_SENTRY_DISABLED=1.
- Sentry captures console output as breadcrumbs and attaches structured error data, which may include operational details.
- A scrubber redacts common credential fields and token-like strings before sending events.
- The flagged Linear credentials are used in an explicit OAuth command and sent to Linear’s token endpoint.
Evidence against
- The README does not document the runtime Sentry reporting found in the source.
- The reporter sends operational error and log context, rather than only anonymous package and runtime metadata.
- The Sentry scrubber reduces the chance that tokens are included in reports.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
Source & flagged code
6 flaggeddist/src/commands/SelfAuthCommand.jsView file
13server = null;
L14: callbackPort = parseInt(process.env.CYRUS_SERVER_PORT || "3456", 10);
L15: async execute(_args) {
...
L32: console.log(" LINEAR_CLIENT_SECRET=your-client-secret");
L33: console.log(" CYRUS_BASE_URL=https://your-tunnel-domain.com");
L34: process.exit(1);
...
L39: try {
L40: config = migrateEdgeConfig(JSON.parse(readFileSync(configPath, "utf-8")));
L41: }
...
L120: .code(400)
L121: .send(`<!DOCTYPE html>
L122: <html><head><meta charset="utf-8"></head>
High
Credential Exfiltration
Source combines credential-like environment material and outbound requests; review data flow before blocking.
dist/src/commands/SelfAuthCommand.jsView on unpkg · L1313Trigger-reachable credential exfiltration chain: scripts.start -> dist/src/app.js -> [redacted].js
L13: server = null;
L14: callbackPort = parseInt(process.env.CYRUS_SERVER_PORT || "3456", 10);
L15: async execute(_args) {
...
L32: console.log(" LINEAR_CLIENT_SECRET=your-client-secret");
L33: console.log(" CYRUS_BASE_URL=https://your-tunnel-domain.com");
L34: process.exit(1);
...
L39: try {
L40: config = migrateEdgeConfig(JSON.parse(readFileSync(configPath, "utf-8")));
L41: }
...
L120: .code(400)
L121: .send(`<!DOCTYPE html>
L122: <html><head><meta charset="utf-8"></head>
High
Trigger Reachable Credential Exfiltration
A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.
dist/src/commands/SelfAuthCommand.jsFindings
2 High6 Medium4 Low
HighCredential Exfiltrationdist/src/commands/SelfAuthCommand.js
HighTrigger Reachable Credential Exfiltrationdist/src/commands/SelfAuthCommand.js
MediumNetwork
MediumEnvironment Vars
MediumAi Review Evidencedist/src/app.js
MediumAi Review Evidencedist/src/services/createErrorReporter.js
MediumAi Review Evidencedist/src/services/createErrorReporter.js
MediumAi Review Evidencedist/src/services/SentryErrorReporter.js
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to cyrus-ai@0.2.75.
The versions list below shows the verdict for each recorded version.
- Review the evidence and your use of cyrus-ai@0.2.75 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.