registry / linkshell-cli / 0.10.64
linkshell-cli@0.10.64
⚠ Under reviewFollow, steer and approve the coding agents on your computer (Claude Code, Codex, Gemini, Copilot and more) from your phone
AI Security Review
scanned 12d ago · by lpm-firewall-aiThe inspected high-signal login and install paths have package-aligned purposes, and the reported command-output exfiltration was not established. Selected runtime dependencies remain unresolved, so the available source does not support either a clean verdict or a confirmed attack.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Using CLI commands that load the host or gateway runtime dependencies.
Impact
The unresolved dependency behavior prevents a clean determination, but does not establish an attack or malicious intent.
Mechanism
The manifest declares these dependencies, and the host command dynamically imports @linkshell/host; the dependency behavior could not be resolved from the available source.
AI rationale
The inspected high-signal login and install paths have package-aligned purposes, and the reported command-output exfiltration was not established. Selected runtime dependencies remain unresolved, so the available source does not support either a clean verdict or a confirmed attack.
Evidence
package.jsondist/cli/src/commands/host.js
Decision evidence
public snapshotAI called this Manual Review at 62.0% confidence as Unknown with medium false-positive risk.
AI review observations
- The manifest declares runtime dependencies on @linkshell/host, @linkshell/wire, and @linkshell/gateway; the CLI dynamically imports @linkshell/host, whose inspected source is unavailable in this snapshot.
- The manifest runs a postinstall script that locates node-pty spawn helpers and changes their permissions; this is a narrowly scoped native dependency setup.
- The inspected login flow sends the received access token to the configured Supabase user endpoint and saves tokens for later use.
Evidence against
- The inspected postinstall behavior is limited to chmod on existing node-pty spawn helpers.
- The inspected login path uses the token to query the Supabase user endpoint and stores it; the scanner's command-output exfiltration claim was not established by these inspected lines.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
Source & flagged code
9 flaggedpackage.jsonView file
•scripts.postinstall = node scripts/postinstall.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.mjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/host/src/ports.jsView file
1import { execFile } from "node:child_process";
L2: import { readlink } from "node:fs/promises";
High
Child Process
Package source references child process execution.
dist/host/src/ports.jsView on unpkg · L1Findings
1 Critical7 High5 Medium4 Low
CriticalPrevious Version Dangerous Deltadist/host/src/drivers/acp/antigravity.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/host/src/ports.js
HighShell
HighCommand Output Exfiltrationdist/cli/src/commands/upgrade.js
HighSandbox Evasion Gated Capabilitydist/cli/src/commands/upgrade.js
HighTrigger Reachable Command Output Exfiltrationdist/cli/src/commands/login.js
HighSemantic Analysis Limiteddist/cli/src/commands/host.js#virtual:normalized:round1
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Requiredist/cli/src/index.js
MediumNetwork
Affected versions and remediation
This report applies to linkshell-cli@0.10.64.
See all versions of linkshell-cli for other recorded verdicts.
- Review the evidence and your use of linkshell-cli@0.10.64 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.