first-tree-staging@0.5.19-staging.1077.1
First Tree — unified CLI for Context Tree onboarding, agent management, and team messaging. (Source-tree dev build; CI rewrites `name` and `bin` for prod / staging publishes — see docs/local-dev-isolation.md.)
AI Security Review
scanned 3mo ago · by lpm-firewall-aiNo concrete credential or command-output exfiltration, remote execution, or unconsented install-time AI-agent control-surface mutation was found. Explicit agent configuration and default telemetry create a real capability/telemetry risk that merits a warning.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
User runs context enable or starts/logs into the First Tree client daemon.
Impact
The user-authorized integration can alter supported agent configuration; telemetry may transmit sanitized diagnostics.
Mechanism
Explicit agent-plugin configuration and sanitized crash telemetry.
AI rationale
No concrete credential or command-output exfiltration, remote execution, or unconsented install-time AI-agent control-surface mutation was found. Explicit agent configuration and default telemetry create a real capability/telemetry risk that merits a warning.
Evidence
package.jsonscripts/prune-codex-runtime-binary.mjsscripts/prune-claude-runtime-binary.mjsscripts/prune-claude-sdk-deps.mjsdist/cli/index.mjsdist/connect-token-Tt01IxG1.mjs
Network endpoints1
o4510502633209856.ingest.us.sentry.io/4511646359486464
Decision evidence
public snapshotAI called this Suspicious at 87.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- dist/cli/index.mjs exposes explicit commands that install/configure Codex and Claude context plugins.
- package.json postinstall runs three pruning scripts that delete selected globally installed SDK packages.
- dist/connect-token-Tt01IxG1.mjs embeds a default Sentry ingest DSN, enabled when the client daemon starts.
Evidence against
- Postinstall is guarded to global installs and targets only named SDK runtime/peer packages.
- Sentry initialization disables default PII and sanitizes tokens, credentials, runtime content, headers, paths, query strings, and breadcrumbs.
- Agent-control changes require explicit context enable arguments plus a plan ID and confirmation/--yes.
- No install-time network request, credential harvesting, remote payload execution, or broad foreign agent-control mutation was found.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket
Source & flagged code
12 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/prune-codex-runtime-binary.mjs && node scripts/prune-claude-runtime-binary.mjs && node scripts/prune-claude-sdk-deps.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/prune-codex-runtime-binary.mjs && node scripts/prune-claude-runtime-binary.mjs && node scripts/prune-claude-sdk-deps.mjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/connect-token-Tt01IxG1.mjsView file
•A module-load call serializes the broad process environment, working directory, and command-line arguments and posts them to a literal external destination.
dist/connect-token-Tt01IxG1.mjs:
* Internal method that keeps a track of which error we have already added, to avoid circular recursion
* Internal method that keeps a track of which error we have already added, to avoid circular recursion
method: {
_req.method = req.method;
const { paths = [], censor = "[REDACTED]", serialize = JSON.stringify, strict = true, remove = false } = options;
return JSON.stringify(cloned);
const writeSym = Symbol("pino.write");
const endSym = Symbol("pino.end");
Findings
4 Critical6 High5 Medium4 Low
CriticalHardcoded Runtime Data Exfiltrationdist/connect-token-Tt01IxG1.mjs
CriticalCredential Exfiltrationdist/connect-token-Tt01IxG1.mjs
CriticalCommand Output Exfiltrationdist/connect-token-Tt01IxG1.mjs
CriticalTrigger Reachable Dangerous Capabilitydist/connect-token-Tt01IxG1.mjs
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/connect-token-Tt01IxG1.mjs
HighShelldist/connect-token-Tt01IxG1.mjs
HighTrigger Reachable Credential Exfiltrationdist/connect-token-Tt01IxG1.mjs
HighTrigger Reachable Persistencedist/connect-token-Tt01IxG1.mjs
HighRuntime Package Installdist/connect-token-Tt01IxG1.mjs
Affected versions and remediation
This report applies to first-tree-staging@0.5.19-staging.1077.1.
See all versions of first-tree-staging for other recorded verdicts.
- Review the evidence and your use of first-tree-staging@0.5.19-staging.1077.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.