linkshell-cli@0.10.76
Follow, steer and approve the coding agents on your computer (Claude Code, Codex, Gemini, Copilot and more) from your phone
AI Security Review
scanned 7d ago · by lpm-firewall-aiThe sign-in flow forwards authentication material to a package-selected endpoint by default, and its handling is unresolved. The evidence supports a credential-exposure warning, while the package postinstall is limited to node-pty helper permissions.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A user signs in with a password or completes browser-based sign-in while the token proxy is enabled, which is the default.
Impact
The proxy receives password or authorization material and may return access and refresh tokens; the inspected source does not establish its handling of that information.
Mechanism
The CLI posts the grant to the fixed proxy and accepts a parsed session response; setting LINKSHELL_TOKEN_PROXY to off skips the proxy.
AI rationale
The sign-in flow forwards authentication material to a package-selected endpoint by default, and its handling is unresolved. The evidence supports a credential-exposure warning, while the package postinstall is limited to node-pty helper permissions.
Evidence
dist/cli/src/commands/sign-in.js
Network endpoints1
itool.tech/api/linkshell/auth
Decision evidence
public snapshotAI called this Suspicious at 83.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The sign-in flow sends authentication grants to a fixed proxy by default; the grant may contain a password or browser authorization material.
- Proxy responses are parsed as access and refresh tokens and used to complete login; the user can disable the proxy with an environment setting, but it is enabled by default.
- Membership checks send the access token to the Supabase URL passed by the caller, not to the sign-in proxy.
- The package postinstall adjusts permissions on node-pty spawn-helper files.
Evidence against
- The proxy is described as forwarding authentication exchanges when Supabase is blocked, and login falls back to Supabase if the proxy gives no verdict.
- The inspected package postinstall only changes permissions on node-pty spawn-helper files.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
Source & flagged code
9 flaggedpackage.jsonView file
•scripts.postinstall = node scripts/postinstall.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.mjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/host/src/ports.jsView file
1import { execFile } from "node:child_process";
L2: import { readlink } from "node:fs/promises";
High
Child Process
Package source references child process execution.
dist/host/src/ports.jsView on unpkg · L1Findings
1 Critical7 High5 Medium4 Low
CriticalPrevious Version Dangerous Deltadist/cli/src/commands/desktop.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/host/src/ports.js
HighShell
HighCommand Output Exfiltrationdist/cli/src/commands/upgrade.js
HighSandbox Evasion Gated Capabilitydist/cli/src/commands/upgrade.js
HighTrigger Reachable Command Output Exfiltrationdist/cli/src/commands/upgrade.js
HighSemantic Analysis Limiteddist/cli/src/commands/host.js#virtual:normalized:round1
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Requiredist/cli/src/index.js
MediumNetwork
Medium
Affected versions and remediation
This report applies to linkshell-cli@0.10.76.
See all versions of linkshell-cli for other recorded verdicts.
- Review the evidence and your use of linkshell-cli@0.10.76 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.