registry / gaoding-cli / 1.0.0-alpha.22

gaoding-cli@1.0.0-alpha.22

Gaoding command-line interface for agents and people.

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

The package has an automatic lifecycle hook that mutates several AI-agent extension directories, creating a meaningful extension-lifecycle risk. Its gating, package-owned payload, and lack of exfiltration or arbitrary execution make a warning more appropriate than a block.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

A supported npm or pnpm global installation runs postinstall.

Impact

Adds or updates the gd-cli agent extension across installed agent hosts.

Mechanism

Postinstall copies or links a bundled skill into detected agent skill directories.

AI rationale

Evidence

package.jsondist/bin/postinstall.jsdist/src/features/skill/installer.jsskills/gd-cli/SKILL.md$HOME/.agents/skills/gd-cli$HOME/.claude/skills/gd-cli$HOME/.codex/skills/gd-cli$HOME/.cursor/skills/gd-cli$HOME/.config/opencode/skills/gd-cli$HOME/.openclaw/skills/gd-cli$HOME/.workbuddy/skills/gd-cli

Decision evidence

public snapshot

AI called this Suspicious at 89.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

Postinstall automatically runs a skill synchronizer during supported global installs.
The synchronizer writes the bundled gd-cli skill into detected AI-agent skill directories.
It can replace previously managed skill directories and creates links or copies in several agent hosts.

Evidence against

The lifecycle is gated to npm or pnpm global-install patterns.
Only the package's own gd-cli skill is installed, with conflict checks and ownership markers.
No secret harvesting, arbitrary command execution, remote payload loading, or self-dependency was found.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 67 file(s), 358 KB of source, external domains: 127.0.0.1, gaoding-log-ai-gpu.cn-hangzhou.log.aliyuncs.com, gdcli.gaoding.com, registry.npmjs.org, www.gaoding.art, www.gaoding.com

Source & flagged code

6 flagged

package.jsonView file

Lines 34-56json

34 "ws": "8.21.1"

35 },

36 "devDependencies": {

37 "@types/ali-oss": "6.23.3",

38 "@types/node": "24.13.3",

39 "@types/qrcode": "1.5.6",

40 "@types/semver": "7.7.1",

41 "@types/ws": "8.18.1",

42 "typescript": "7.0.2",

43 "vitest": "4.1.10",

44 "@gaoding/gd-connector-contracts": "0.1.0"

45 },

46 "scripts": {

47 "contracts:build": "pnpm --filter @gaoding/gd-connector-contracts build",

48 "clean": "node -e \"for (const p of ['contracts', 'dist']) require('node:fs').rmSync(p, { recursive: true, force: true })\"",

49 "bundle:contracts": "node scripts/bundle-contracts.mjs",

50 "build": "pnpm contracts:build && pnpm clean && tsc -p tsconfig.build.json && pnpm bundle:contracts",

51 "test": "pnpm contracts:build && vitest run",

52 "typecheck": "pnpm contracts:build && tsc -p tsconfig.json",

53 "check": "pnpm contracts:build && vitest run && tsc -p tsconfig.json && pnpm clean && tsc -p tsconfig.build.json && pnpm bundle:contracts",

54 "postinstall": "node -e \"const p='./dist/bin/postinstall.js'; if (require('node:fs').existsSync(p)) import(p)\""

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg · L54

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L54

55 }

56}

dist/src/features/dam/object-storage.jsView file

Lines 1-32javascript

1import { createHmac } from "node:crypto";

2import { createReadStream } from "node:fs";

3import { stat } from "node:fs/promises";

4import OSS from "ali-oss"

dist/src/features/update/update-service.jsView file

Lines 1-21javascript

1import { spawn } from "node:child_process";

2import { realpathSync } from "node:fs";

3import { resolve } from "node:path";

4import { gt, valid } from "semver"

dist/src/platform/url-safety.jsView file

Lines 1-21javascript

1import { isIP } from "node:net";

2export class UrlSafetyError extends Error {

3 constructor() {

4 super("URL 不可用于远程素材。");

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node -e "const p='./dist/bin/postinstall.js'; if (require('node:fs').existsSync(p)) import(p)"

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg

•scripts.postinstall = node -e "const p='./dist/bin/postinstall.js'; if (require('node:fs').existsSync(p)) import(p)"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/src/features/dam/object-storage.jsView file

12try { L13: const url = new URL(value.includes("://") ? value : `https://${value}`); L14: if (url.protocol !== "http:" && url.protocol !== "https:") { ... L130: .update(stringToSign) L131: .digest("base64"); L132: const stream = createReadStream(input.filePath); ... L142: }, L143: body: stream, L144: signal: input.signal,

Findings

2 Critical3 High3 Medium5 Low

CriticalRed Install Lifecycle Scriptpackage.json

CriticalPrevious Version Dangerous Deltadist/src/features/update/update-service.js

HighInstall Time Lifecycle Scriptspackage.json

HighSandbox Evasion Gated Capabilitydist/src/features/update/update-service.js

HighCloud Metadata Accessdist/src/platform/url-safety.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowWeak Cryptodist/src/features/dam/object-storage.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to gaoding-cli@1.0.0-alpha.22.

See all versions of gaoding-cli for other recorded verdicts.

Review the evidence and your use of gaoding-cli@1.0.0-alpha.22 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-08-30 00:36:09.929Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.