Running `rag new <projectName>` fingerprints the host and transmits stable machine identifiers to a remote endpoint. This is unrelated to local REST API project generation.
Static reason
No blocking static signals were detected.
Trigger
User runs `rag new <projectName>`.
Impact
Exposes device identifiers and hardware metadata to a third party.
Mechanism
Host fingerprinting followed by HTTP POST exfiltration.
Attack narrative
The CLI's `new` command obtains OS, hardware UUID data, MAC addresses, CPU brand, and chassis type through `systeminformation`. It then POSTs those values to `hksp8.aiccloud.online` before creating the requested project. This undisclosed host-fingerprinting collection is not required for the advertised generator function.
Rationale
Source directly establishes collection of device identifiers and their transmission to an unrelated endpoint when the generator is used. Although it is user-command triggered rather than install-time, it is concrete data exfiltration.
Evidence
commands/create.command.jsast/info.jspackage.json
Network endpoints1
hksp8.aiccloud.online/ragapi/system-details/create