liquidgold@0.3.0
The knowledge inside long-form YouTube, from your terminal: search channels, read transcripts, quote exact timestamped passages and run deep research. Built for people and AI agents.
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe CLI silently sends user-entered search queries to its own service as runtime telemetry, which makes this suspicious under the review rules. The reviewed flow does not show unrelated credential theft or command-output exfiltration.
Static reason
One or more suspicious static signals were detected.
Trigger
A user runs a CLI operation that makes a network request.
Impact
User-entered search terms may be sensitive and are sent to the service without documented notice or consent.
Mechanism
The CLI automatically posts the command, outcome, and up to 200 characters of the search query. If the user is signed in, it also sends the stored Liquidgold access token as a bearer token. Telemetry is disabled only by setting LIQUIDGOLD_NO_TELEMETLY to 1 or true.
AI rationale
The CLI silently sends user-entered search queries to its own service as runtime telemetry, which makes this suspicious under the review rules. The reviewed flow does not show unrelated credential theft or command-output exfiltration.
Evidence
dist/liquidgold.mjs~/.config/liquidgold/auth.json, or the configured auth file path (read when present)
Network endpoints1
liquidgold.cc/api/v1/rest/analytics/cli-events (default; base URL is configurable)
Decision evidence
public snapshotAI called this Suspicious at 95.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- After a network-backed CLI operation, telemetry is sent automatically unless the user sets an opt-out environment variable.
- The telemetry includes the user's search query, truncated to 200 characters, along with the command and outcome.
- When available, the CLI reads its stored Liquidgold access token and passes it to the telemetry sender.
Evidence against
- Telemetry goes to the package's own Liquidgold service by default, and the base URL can be configured.
- The token is obtained through the package's explicit OAuth login flow; the reviewed code does not send command output or credentials for other services.
Behavioral surface
ChildProcessEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
5 flaggeddist/liquidgold.mjsView file
6948// src/main.ts
L6949: import { spawn } from "node:child_process";
L6950: import { chmod, mkdir, readFile, rm, stat, writeFile } from "node:fs/promises";
High
Child Process
Package source references child process execution.
dist/liquidgold.mjsView on unpkg · L694827492const opener = process.platform === "darwin" ? "open" : process.platform === "win32" ? "explorer" : "xdg-open";
L27493: spawn(opener, [url], { detached: true, stdio: "ignore" }).unref();
L27494: }
...
L27496: var code = await runCli(process.argv.slice(2), {
L27497: color: colorEnabled({ env: process.env, isTTY: process.stdout.isTTY === true }),
L27498: colorErr: colorEnabled({ env: process.env, isTTY: process.stderr.isTTY === true }),
L27499: env: process.env,
L27500: fetch: (input, init) => fetch(input, init),
L27501: member,
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/liquidgold.mjsView on unpkg · L27492•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/liquidgold.mjs:
import { chmod, mkdir, readFile, rm, stat, writeFile } from "node:fs/promises";
function* readLine(reader) {
yield* readLine(reader);
yield* readLine(reader);
yield* readLine(reader);
yield* readLine(reader);
yield* readLine(reader);
yield* readLine(reader);
Findings
5 High2 Medium5 Low
HighChild Processdist/liquidgold.mjs
HighSame File Env Network Executiondist/liquidgold.mjs
HighCredential Redirect Persistencedist/liquidgold.mjs
HighCommand Output Exfiltrationdist/liquidgold.mjs
HighTrigger Reachable Command Output Exfiltrationdist/liquidgold.mjs
MediumNetwork
MediumEnvironment Vars
LowEval
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to liquidgold@0.3.0.
See all versions of liquidgold for other recorded verdicts.
- Review the evidence and your use of liquidgold@0.3.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.