registry / linkshell-cli / 0.7.0
linkshell-cli@0.7.0
Follow, steer and approve the coding agents on your computer (Claude Code, Codex, Gemini, Copilot and more) from your phone
AI Security Review
scanned 26d ago · by lpm-firewall-aiInspected source shows a package-aligned terminal and agent tool, with a postinstall permission fix and cleanup limited to its own historical hooks. Scanner signals such as process execution and networking correspond to login, upgrade, and host functionality; no concrete attack behavior was established.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Package installation runs the postinstall hook; starting a host session invokes the one-shot hook cleanup.
Impact
No credential theft, unrelated agent configuration mutation, or other concrete attack impact was established.
Mechanism
The install hook applies executable permissions to existing node-pty helpers. Host startup filters LinkShell-specific hook entries from known settings files.
AI rationale
Inspected source shows a package-aligned terminal and agent tool, with a postinstall permission fix and cleanup limited to its own historical hooks. Scanner signals such as process execution and networking correspond to login, upgrade, and host functionality; no concrete attack behavior was established.
Evidence
package.jsonscripts/postinstall.mjssrc/runtime/hook-command.tssrc/runtime/bridge-session.ts
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The postinstall hook fixes permissions on node-pty helper binaries; it does not install another release or modify agent configuration.
- Host startup removes only matching historical LinkShell hook entries from agent settings files.
- The Claude SDK client’s cited location identifies Claude project storage; it does not show an agent configuration write.
- Login receives tokens through a localhost callback and saves them as login state; the inspected flow does not show them being sent to an unrelated recipient.
- The upgrade path checks the npm registry and invokes Homebrew only when the user runs the upgrade command.
- Inspected source supports package-aligned terminal and agent operation; no concrete attack behavior was established.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShellWebSocket
Source & flagged code
10 flaggedpackage.jsonView file
•scripts.postinstall = node scripts/postinstall.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.mjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/host/src/ports.jsView file
1import { execFile } from "node:child_process";
L2: import { readlink } from "node:fs/promises";
High
Child Process
Package source references child process execution.
dist/host/src/ports.jsView on unpkg · L1Findings
1 Critical7 High4 Medium5 Low
CriticalPrevious Version Dangerous Deltadist/cli/src/commands/host.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/host/src/ports.js
HighShelldist/cli/src/runtime/screen-fallback.js
HighCommand Output Exfiltrationdist/cli/src/commands/login.js
HighTrigger Reachable Command Output Exfiltrationdist/cli/src/commands/login.js
HighRuntime Package Installdist/cli/src/commands/upgrade.js
HighSemantic Analysis Limiteddist/cli/src/commands/host.js#virtual:normalized:round1
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
Affected versions and remediation
This report applies to linkshell-cli@0.7.0.
See all versions of linkshell-cli for other recorded verdicts.
- Review the evidence and your use of linkshell-cli@0.7.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.