linkshell-cli@0.10.68
⚠ Under reviewFollow, steer and approve the coding agents on your computer (Claude Code, Codex, Gemini, Copilot and more) from your phone
AI Security Review
scanned 11d ago · by lpm-firewall-aiThe inspected lifecycle helper changes permissions on known node-pty helper files, and login and host token handling follow the inspected service flow. Because selected runtime dependency source remains unavailable, a clean verdict is not supported; the inspected evidence does not establish malicious behavior.
Decision evidence
public snapshot- package.json declares a postinstall helper; scripts/postinstall.mjs resolves node-pty and adjusts permissions on existing spawn-helper files.
- The inspected login code validates tokens with the configured Supabase service and saves them locally; the host supplies an account token only when using the official gateway.
- The manifest declares runtime dependencies on @linkshell/wire, @linkshell/host, and @linkshell/gateway; the host entrypoint dynamically imports @linkshell/host.
- Inspected node-pty install scripts prepare platform prebuilds, and its library exposes terminal spawning.
- Source for selected runtime dependencies @linkshell/wire, @linkshell/host, and @linkshell/gateway was not available for inspection, so their behavior remains unresolved.
Source & flagged code
8 flaggedPackage defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgPackage source references child process execution.
dist/host/src/ports.jsView on unpkg · L1Findings
Affected versions and remediation
This report applies to linkshell-cli@0.10.68.
See all versions of linkshell-cli for other recorded verdicts.
- Review the evidence and your use of linkshell-cli@0.10.68 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.