registry / gaoding-cli / 1.0.0-alpha.17
gaoding-cli@1.0.0-alpha.17
Gaoding command-line interface for agents and people.
AI Security Review
scanned 13d ago · by lpm-firewall-aiThe source confirms guarded first-party agent skill setup from postinstall and explicit update paths, which warrants a warning under the agent extension lifecycle policy. It does not establish malicious behavior or a publish-blocking attack.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A supported global npm or pnpm installation invokes postinstall; the same skill synchronization is also available through the CLI update flow.
Impact
The skill becomes available to those agent tools and may be refreshed on a later global install or explicit update.
Mechanism
The hook loads the bundled gd-cli skill and synchronizes it to the canonical and detected agent skills directories, replacing managed copies when needed.
AI rationale
The source confirms guarded first-party agent skill setup from postinstall and explicit update paths, which warrants a warning under the agent extension lifecycle policy. It does not establish malicious behavior or a publish-blocking attack.
Evidence
package.jsondist/bin/postinstall.jsdist/src/features/skill/installer.jsdist/src/features/skill/bundled-skills.jsdist/src/bootstrap/create-runtime.jsdist/src/platform/url-safety.js~/.claude/skills/gd-cli~/.codex/skills/gd-cli~/.cursor/skills/gd-cli
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- package.json defines a postinstall hook that loads the bundled postinstall entrypoint.
- The hook only proceeds for supported global npm or pnpm lifecycle contexts, with the pnpm path checking install context and package identity.
- The installer detects agent directories and synchronizes a bundled skill into their skills directories.
- The bundled source is limited to this package’s own gd-cli skill; managed directories are staged and replaced with that source.
- The update service is also reachable through the CLI runtime and synchronizes skills during an explicit update.
Evidence against
- The inspected source shows guarded first-party skill setup, not a foreign agent configuration write or credential transfer.
- The URL safety helper rejects localhost, metadata, and private IP destinations for remote asset URLs.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkWebSocket
Source & flagged code
5 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node -e "const p='./dist/bin/postinstall.js'; if (require('node:fs').existsSync(p)) import(p)"
Critical
Red Install Lifecycle Script
Install-time lifecycle script matches a deterministic static-gate block pattern.
package.jsonView on unpkg•scripts.postinstall = node -e "const p='./dist/bin/postinstall.js'; if (require('node:fs').existsSync(p)) import(p)"
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgdist/src/features/dam/object-storage.jsView file
12try {
L13: const url = new URL(value.includes("://") ? value : `https://${value}`);
L14: if (url.protocol !== "http:" && url.protocol !== "https:") {
...
L130: .update(stringToSign)
L131: .digest("base64");
L132: const stream = createReadStream(input.filePath);
...
L142: },
L143: body: stream,
L144: signal: input.signal,
Findings
1 Critical3 High3 Medium5 Low
CriticalRed Install Lifecycle Scriptpackage.json
HighInstall Time Lifecycle Scriptspackage.json
HighSandbox Evasion Gated Capabilitydist/src/features/update/update-service.js
HighCloud Metadata Accessdist/src/platform/url-safety.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowWeak Cryptodist/src/features/dam/object-storage.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to gaoding-cli@1.0.0-alpha.17.
See all versions of gaoding-cli for other recorded verdicts.
- Review the evidence and your use of gaoding-cli@1.0.0-alpha.17 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.