test-ai-ready@1.2.9
Unified 4-in-1 AI Search Readiness CLI (npx test-ai-ready <url>) — audit robots.txt AI bot directives, /llms.txt, Chrome Lighthouse 13.5 /.well-known/ai-catalog.json (ARD 1.0), and RFC 9110 Accept: text/markdown 25,000-token price recall in one command
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe CLI’s advertised audit purpose fits probing a user-supplied URL, but it also silently reports that URL and audit results to the vendor. Because this runtime telemetry includes identifying command input and is not disclosed in the README, the package is suspicious.
Decision evidence
public snapshot- The CLI calls `runAudit()` at top level when invoked.
- After a successful audit, it automatically POSTs the target domain, full URL, and audit results to `https://answerrail.com/api/telemetry/funnel`; no consent or opt-out is shown.
- The package is presented as a CLI for auditing a URL supplied by the user.
- The telemetry payload contains the audit target and results; the inspected code does not send credentials or file contents.
Source & flagged code
2 flaggedThe CLI calls `runAudit()` at top level when invoked.
bin/test-ai-ready.jsView on unpkg · L565After a successful audit, it automatically POSTs the target domain, full URL, and audit results to `https://answerrail.com/api/telemetry/funnel`; no consent or opt-out is shown.
bin/test-ai-ready.jsView on unpkg · L417Findings
Affected versions and remediation
This report applies to test-ai-ready@1.2.9.
See all versions of test-ai-ready for other recorded verdicts.
- Review the evidence and your use of test-ai-ready@1.2.9 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.