registry / gaoding-cli / 1.0.0-alpha.19

gaoding-cli@1.0.0-alpha.19

Gaoding command-line interface for agents and people.

AI Security Review

scanned 13d ago · by lpm-firewall-ai

The postinstall hook performs guarded first-party agent skill setup, which creates a real agent extension lifecycle risk. The inspected code does not establish an unconsented broad control-surface mutation or other concrete malicious behavior, so this warrants a warning rather than a block.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

A supported global npm or pnpm postinstall lifecycle.

Impact

Bundled skills may become available to supported agent tools; the inspected code does not establish changes to broader agent configuration.

Mechanism

The lifecycle loads bundled skills and synchronizes them into the canonical skills directory and detected agent-specific skills directories.

AI rationale

Evidence

package.jsondist/bin/postinstall.jsdist/src/features/skill/installer.js~/.agents/skills/<skill>~/.claude/skills/<skill>~/.codex/skills/<skill>~/.cursor/skills/<skill>

Decision evidence

public snapshot

AI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

package.json runs a postinstall script that conditionally imports dist/bin/postinstall.js.
The postinstall routine is gated to supported global installs and synchronizes bundled skills.
Skill targets include detected agent directories such as .claude, .codex, and .cursor.
The installer stages and replaces package-managed skill directories.
The update command has a separate user-invoked path that installs gaoding-cli globally.

Evidence against

The lifecycle gate limits automatic execution to supported global package-manager installs.
The skill installer targets skill subdirectories and checks ownership markers before replacing managed content; no broad agent configuration mutation is established.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsUrlStrings

Source & flagged code

5 flagged

package.jsonView file

Lines 34-56json

34 "ws": "8.21.1"

35 },

36 "devDependencies": {

37 "@types/ali-oss": "6.23.3",

38 "@types/node": "24.13.3",

39 "@types/qrcode": "1.5.6",

40 "@types/semver": "7.7.1",

41 "@types/ws": "8.18.1",

42 "typescript": "7.0.2",

43 "vitest": "4.1.10",

44 "@gaoding/gd-connector-contracts": "0.1.0"

45 },

46 "scripts": {

47 "contracts:build": "pnpm --filter @gaoding/gd-connector-contracts build",

48 "clean": "node -e \"for (const p of ['contracts', 'dist']) require('node:fs').rmSync(p, { recursive: true, force: true })\"",

49 "bundle:contracts": "node scripts/bundle-contracts.mjs",

50 "build": "pnpm contracts:build && pnpm clean && tsc -p tsconfig.build.json && pnpm bundle:contracts",

51 "test": "pnpm contracts:build && vitest run",

52 "typecheck": "pnpm contracts:build && tsc -p tsconfig.json",

53 "check": "pnpm contracts:build && vitest run && tsc -p tsconfig.json && pnpm clean && tsc -p tsconfig.build.json && pnpm bundle:contracts",

54 "postinstall": "node -e \"const p='./dist/bin/postinstall.js'; if (require('node:fs').existsSync(p)) import(p)\""

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg · L54

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L54

55 }

56}

dist/src/features/dam/object-storage.jsView file

Lines 1-32javascript

1import { createHmac } from "node:crypto";

2import { createReadStream } from "node:fs";

3import { stat } from "node:fs/promises";

4import OSS from "ali-oss"

dist/src/features/update/update-service.jsView file

Lines 1-21javascript

1import { spawn } from "node:child_process";

2import { realpathSync } from "node:fs";

3import { resolve } from "node:path";

4import { gt, valid } from "semver"

dist/src/platform/url-safety.jsView file

Lines 1-21javascript

1import { isIP } from "node:net";

2export class UrlSafetyError extends Error {

3 constructor() {

4 super("URL 不可用于远程素材。");

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = node -e "const p='./dist/bin/postinstall.js'; if (require('node:fs').existsSync(p)) import(p)"

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg

•scripts.postinstall = node -e "const p='./dist/bin/postinstall.js'; if (require('node:fs').existsSync(p)) import(p)"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/src/features/dam/object-storage.jsView file

12try { L13: const url = new URL(value.includes("://") ? value : `https://${value}`); L14: if (url.protocol !== "http:" && url.protocol !== "https:") { ... L130: .update(stringToSign) L131: .digest("base64"); L132: const stream = createReadStream(input.filePath); ... L142: }, L143: body: stream, L144: signal: input.signal,

Findings

1 Critical3 High3 Medium5 Low

CriticalRed Install Lifecycle Scriptpackage.json

HighInstall Time Lifecycle Scriptspackage.json

HighSandbox Evasion Gated Capabilitydist/src/features/update/update-service.js

HighCloud Metadata Accessdist/src/platform/url-safety.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowWeak Cryptodist/src/features/dam/object-storage.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to gaoding-cli@1.0.0-alpha.19.

See all versions of gaoding-cli for other recorded verdicts.

Review the evidence and your use of gaoding-cli@1.0.0-alpha.19 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-10 02:28:35.523Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.