registry / linkshell-cli / 0.6.3
linkshell-cli@0.6.3
Follow, steer and approve the coding agents on your computer (Claude Code, Codex, Gemini, Copilot and more) from your phone
AI Security Review
scanned 26d ago · by lpm-firewall-aiInspected source shows a limited node-pty permission fix, cleanup of LinkShell-owned hooks, and expected login and host operations. The flagged process, network, and upgrade behavior did not establish a concrete attack.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Installation runs the postinstall script; host startup runs the legacy hook cleanup.
Impact
No malicious impact was established from these behaviors or the inspected login, host, and port code.
Mechanism
The installer chmods existing node-pty spawn helpers. The cleanup checks known agent settings files and removes entries matching LinkShell hook patterns.
AI rationale
Inspected source shows a limited node-pty permission fix, cleanup of LinkShell-owned hooks, and expected login and host operations. The flagged process, network, and upgrade behavior did not establish a concrete attack.
Evidence
package.jsonscripts/postinstall.mjssrc/runtime/hook-command.tssrc/runtime/bridge-session.tssrc/runtime/acp/claude-sdk-client.tsdist/cli/src/runtime/hook-command.jsdist/host/src/ports.jsdist/cli/src/runtime/screen-fallback.jsdist/cli/src/commands/login.jsdist/cli/src/commands/upgrade.jsdist/cli/src/commands/host.js
Network endpoints2
itool.tech/en/auth/linkshellregistry.npmjs.org/linkshell-cli/latest
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json runs a postinstall script; scripts/postinstall.mjs only fixes node-pty helper permissions.
- src/runtime/hook-command.ts filters out LinkShell-owned hooks, and src/runtime/bridge-session.ts calls that cleanup during host startup.
- The inspected Claude SDK excerpt builds paths for the current project’s Claude session data.
- dist/cli/src/commands/login.js sends the login token to the configured Supabase auth service and saves the returned credentials.
- The inspected host and port code starts the selected agent process and probes local HTTP ports for forwarding.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShellWebSocket
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
10 flaggedpackage.jsonView file
•scripts.postinstall = node scripts/postinstall.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.mjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/host/src/ports.jsView file
1import { execFile } from "node:child_process";
L2: import { readlink } from "node:fs/promises";
High
Child Process
Package source references child process execution.
dist/host/src/ports.jsView on unpkg · L1Findings
1 Critical7 High4 Medium5 Low
CriticalPrevious Version Dangerous Deltadist/cli/src/commands/host.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/host/src/ports.js
HighShelldist/cli/src/runtime/screen-fallback.js
HighCommand Output Exfiltrationdist/cli/src/commands/login.js
HighTrigger Reachable Command Output Exfiltrationdist/cli/src/commands/login.js
HighRuntime Package Installdist/cli/src/commands/upgrade.js
HighSemantic Analysis Limiteddist/cli/src/commands/host.js#virtual:normalized:round1
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
Affected versions and remediation
This report applies to linkshell-cli@0.6.3.
See all versions of linkshell-cli for other recorded verdicts.
- Review the evidence and your use of linkshell-cli@0.6.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.