registry / gaoding-cli / 1.0.0-alpha.21
gaoding-cli@1.0.0-alpha.21
Gaoding command-line interface for agents and people.
AI Security Review
scanned 13d ago · by lpm-firewall-aiThe package has an install-time hook that can install its bundled agent skill in detected agent directories during supported global installs. This guarded first-party extension setup warrants a warning, while the inspected network and URL validation code does not establish a concrete attack.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A supported global npm or pnpm install lifecycle.
Impact
Agent hosts may receive the package-owned skill automatically as part of global installation.
Mechanism
The handler loads the bundled gd-cli skill and synchronizes it into canonical and detected agent skill directories.
AI rationale
The package has an install-time hook that can install its bundled agent skill in detected agent directories during supported global installs. This guarded first-party extension setup warrants a warning, while the inspected network and URL validation code does not establish a concrete attack.
Evidence
package.jsondist/bin/postinstall.jsdist/src/features/skill/installer.jsdist/src/features/skill/bundled-skills.js~/.agents/skills/gd-clidetected agent skill directories
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- package.json runs a postinstall script that imports dist/bin/postinstall.js.
- The postinstall handler gates skill synchronization to supported global npm/pnpm lifecycle contexts.
- The installer discovers existing agent directories and places the package-owned gd-cli skill there.
- The installed skill is copied from the package’s bundled skills/gd-cli directory.
Evidence against
- The update service fetches package metadata from the npm registry and rejects redirects.
- The remote asset URL validator rejects localhost, metadata, and private IP destinations.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
5 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node -e "const p='./dist/bin/postinstall.js'; if (require('node:fs').existsSync(p)) import(p)"
Critical
Red Install Lifecycle Script
Install-time lifecycle script matches a deterministic static-gate block pattern.
package.jsonView on unpkg•scripts.postinstall = node -e "const p='./dist/bin/postinstall.js'; if (require('node:fs').existsSync(p)) import(p)"
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgdist/src/features/dam/object-storage.jsView file
12try {
L13: const url = new URL(value.includes("://") ? value : `https://${value}`);
L14: if (url.protocol !== "http:" && url.protocol !== "https:") {
...
L130: .update(stringToSign)
L131: .digest("base64");
L132: const stream = createReadStream(input.filePath);
...
L142: },
L143: body: stream,
L144: signal: input.signal,
Findings
1 Critical3 High3 Medium5 Low
CriticalRed Install Lifecycle Scriptpackage.json
HighInstall Time Lifecycle Scriptspackage.json
HighSandbox Evasion Gated Capabilitydist/src/features/update/update-service.js
HighCloud Metadata Accessdist/src/platform/url-safety.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowWeak Cryptodist/src/features/dam/object-storage.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to gaoding-cli@1.0.0-alpha.21.
See all versions of gaoding-cli for other recorded verdicts.
- Review the evidence and your use of gaoding-cli@1.0.0-alpha.21 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.