registry / linkshell-cli / 0.5.32
linkshell-cli@0.5.32
Remote terminal bridge for Claude Code / Codex / Gemini / Copilot — control from your phone
AI Security Review
scanned 4mo ago · by lpm-firewall-aiStatic inspection found high-risk primitives, but they are runtime/user-invoked and consistent with the documented remote terminal and agent workspace product. The install hook is limited to local node-pty permission repair and no credential harvesting, covert exfiltration, persistence, or lifecycle AI-agent control mutation was confirmed.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
User runs linkshell start/login/upgrade or related runtime commands
Impact
Remote control of the user's chosen terminal/agent session when explicitly started
Mechanism
user-invoked remote terminal and agent bridge with local config writes
AI rationale
Static inspection found high-risk primitives, but they are runtime/user-invoked and consistent with the documented remote terminal and agent workspace product. The install hook is limited to local node-pty permission repair and no credential harvesting, covert exfiltration, persistence, or lifecycle AI-agent control mutation was confirmed.
Evidence
package.jsonscripts/postinstall.mjsREADME.mdsrc/index.tssrc/auth.tssrc/runtime/bridge-session.tssrc/runtime/acp/claude-stream-json-client.tssrc/commands/login.tssrc/commands/upgrade.ts~/.linkshell/auth.json~/.linkshell/config.json~/.linkshell/machine.json~/.claude/settings.json~/.codex/config.toml~/.codex/hooks.json~/.gemini/settings.jsonhooks.json
Network endpoints4
mkbeusztkzffnzjdwmqk.supabase.coitool.tech/en/auth/linkshellregistry.npmjs.org/linkshell-cli/latest
Decision evidence
public snapshotAI called this Clean at 86.0% confidence as Benign with medium false-positive risk.
Evidence for AI clean decision
- src/runtime/bridge-session.ts writes Claude/Codex/Gemini/Copilot hook config during linkshell start
- src/runtime/acp/claude-stream-json-client.ts can run Claude fallback with bypassPermissions for remote prompts
- src/commands/upgrade.ts runs npm install -g only when user invokes linkshell upgrade
Evidence against
- scripts/postinstall.mjs only chmods node-pty spawn-helper candidates; no network or payload fetch
- README.md describes remote terminal/agent bridge, screen sharing, login, gateway, and hook-like agent workspace behavior
- Network calls are package-aligned: Supabase auth, itool.tech login, npm registry update check, configured gateway WebSocket
- Auth token storage is local ~/.linkshell/auth.json with mode 0600 and used for LinkShell gateway/auth APIs
- Shell/PTY spawning is the core advertised CLI bridge behavior and is activated by explicit runtime commands
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEval
Source & flagged code
15 flaggedpackage.jsonView file
•scripts.postinstall = node scripts/postinstall.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.mjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/cli/src/auth.jsView file
39patternName = supabase_service_key
severity = critical
line = 39
matchedText = const SU...P0";
Critical
Critical Secret
Package contains a critical-looking secret pattern.
dist/cli/src/auth.jsView on unpkg · L39Findings
6 Critical6 High5 Medium6 Low
CriticalCritical Secretdist/cli/src/auth.js
CriticalPrevious Version Dangerous Deltadist/cli/src/runtime/acp/claude-stream-json-client.js
CriticalSecret Patterndist/cli/src/auth.js
CriticalSecret Patterndist/cli/src/auth.d.ts
CriticalSecret Patternweb/assets/index-DMiyoLqp.js
CriticalSecret Patternsrc/auth.ts
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/cli/src/runtime/acp-relay.js
HighShelldist/cli/src/runtime/screen-fallback.js
HighCommand Output Exfiltrationdist/cli/src/commands/login.js
HighCopied Package Dependency Bridgedist/cli/src/commands/doctor.js
Affected versions and remediation
This report applies to linkshell-cli@0.5.32.
See all versions of linkshell-cli for other recorded verdicts.
- Review the evidence and your use of linkshell-cli@0.5.32 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.