registry / gaoding-cli / 1.0.0-alpha.20

gaoding-cli@1.0.0-alpha.20

Gaoding command-line interface for agents and people.

AI Security Review

scanned 13d ago · by lpm-firewall-ai

The postinstall hook can write package-owned skill files into detected agent directories, but the lifecycle is gated to supported global installs and the inspected behavior is an agent extension setup capability. This supports a warning for guarded agent extension lifecycle risk, not a confirmed attack.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm postinstall during a supported global npm or pnpm installation.

Impact

Agent hosts may receive or have managed bundled skill files updated as part of global installation.

Mechanism

The lifecycle loads the package's bundled skills and synchronizes them into managed locations under detected agent host directories.

AI rationale

Evidence

dist/bin/postinstall.jsdist/src/features/skill/installer.jspackage.json

Decision evidence

public snapshot

AI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

package.json runs a postinstall entrypoint.
The lifecycle performs bundled skill synchronization only for supported global npm or pnpm installs.
Synchronization targets agent skill directories under detected host roots, including Claude, Codex, and Cursor.
The installer copies bundled skill content into managed directories, creating an agent extension during installation.
Update synchronization is also available through the update service.
URL safety code rejects non-HTTP(S) URLs and embedded URL credentials.

Evidence against

The lifecycle has explicit global-install checks and returns without syncing when they fail.
The inspected sources show bundled skill setup and update behavior, not credential collection or an unrelated network payload.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

Source & flagged code

5 flagged

package.jsonView file

Lines 34-56json

34 "ws": "8.21.1"

35 },

36 "devDependencies": {

37 "@types/ali-oss": "6.23.3",

38 "@types/node": "24.13.3",

39 "@types/qrcode": "1.5.6",

40 "@types/semver": "7.7.1",

41 "@types/ws": "8.18.1",

42 "typescript": "7.0.2",

43 "vitest": "4.1.10",

44 "@gaoding/gd-connector-contracts": "0.1.0"

45 },

46 "scripts": {

47 "contracts:build": "pnpm --filter @gaoding/gd-connector-contracts build",

48 "clean": "node -e \"for (const p of ['contracts', 'dist']) require('node:fs').rmSync(p, { recursive: true, force: true })\"",

49 "bundle:contracts": "node scripts/bundle-contracts.mjs",

50 "build": "pnpm contracts:build && pnpm clean && tsc -p tsconfig.build.json && pnpm bundle:contracts",

51 "test": "pnpm contracts:build && vitest run",

52 "typecheck": "pnpm contracts:build && tsc -p tsconfig.json",

53 "check": "pnpm contracts:build && vitest run && tsc -p tsconfig.json && pnpm clean && tsc -p tsconfig.build.json && pnpm bundle:contracts",

54 "postinstall": "node -e \"const p='./dist/bin/postinstall.js'; if (require('node:fs').existsSync(p)) import(p)\""

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg · L54

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L54

55 }

56}

dist/src/features/dam/object-storage.jsView file

Lines 1-32javascript

1import { createHmac } from "node:crypto";

2import { createReadStream } from "node:fs";

3import { stat } from "node:fs/promises";

4import OSS from "ali-oss"

dist/src/features/update/update-service.jsView file

Lines 1-21javascript

1import { spawn } from "node:child_process";

2import { realpathSync } from "node:fs";

3import { resolve } from "node:path";

4import { gt, valid } from "semver"

dist/src/platform/url-safety.jsView file

Lines 1-21javascript

1import { isIP } from "node:net";

2export class UrlSafetyError extends Error {

3 constructor() {

4 super("URL 不可用于远程素材。");

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = node -e "const p='./dist/bin/postinstall.js'; if (require('node:fs').existsSync(p)) import(p)"

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg

•scripts.postinstall = node -e "const p='./dist/bin/postinstall.js'; if (require('node:fs').existsSync(p)) import(p)"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/src/features/dam/object-storage.jsView file

12try { L13: const url = new URL(value.includes("://") ? value : `https://${value}`); L14: if (url.protocol !== "http:" && url.protocol !== "https:") { ... L130: .update(stringToSign) L131: .digest("base64"); L132: const stream = createReadStream(input.filePath); ... L142: }, L143: body: stream, L144: signal: input.signal,

Findings

1 Critical3 High3 Medium5 Low

CriticalRed Install Lifecycle Scriptpackage.json

HighInstall Time Lifecycle Scriptspackage.json

HighSandbox Evasion Gated Capabilitydist/src/features/update/update-service.js

HighCloud Metadata Accessdist/src/platform/url-safety.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowWeak Cryptodist/src/features/dam/object-storage.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to gaoding-cli@1.0.0-alpha.20.

See all versions of gaoding-cli for other recorded verdicts.

Review the evidence and your use of gaoding-cli@1.0.0-alpha.20 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-10 02:29:06.871Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.