wgc@0.129.9
The official CLI tool to manage the GraphQL Federation Platform Cosmo
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThis is not malicious or block-worthy because the write is user-triggered and project-local. Per policy, explicit agent-config mutation remains a warn-level capability.
Static reason
One or more suspicious static signals were detected.
Trigger
User runs `wgc router plugin init`.
Impact
Adds agent-facing development guidance to the user-selected plugin project.
Mechanism
Explicit project-local Cursor rule scaffolding.
AI rationale
This is not malicious or block-worthy because the write is user-triggered and project-local. Per policy, explicit agent-config mutation remains a warn-level capability.
Evidence
package.jsondist/src/commands/router/commands/plugin/commands/init.jsdist/src/commands/router/commands/plugin/templates/typescript.jsdist/src/core/plugin-publish.jsdist/src/core/telemetry.js.cursor/rules/plugin-development.mdc
Decision evidence
public snapshotAI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Explicit `wgc router plugin init` creates a Cursor rules directory and writes `plugin-development.mdc` into the generated project.
Evidence against
- package.json has no npm preinstall/install/postinstall lifecycle hook.
- The Cursor write is confined to the explicitly requested plugin scaffold command.
- The emitted rule is a plugin-development guide; no credential harvesting, exfiltration, or destructive action was found.
- Docker, network, and tool-install commands are tied to explicit build/publish workflows.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsMinifiedTelemetryUrlStrings
Source & flagged code
6 flaggeddist/src/core/plugin-publish.jsView file
7import { splitLabel } from '@wundergraph/cosmo-shared';
L8: import { execa } from 'execa';
L9: import { config, getBaseHeaders } from './config.js';
High
dist/src/commands/router/commands/plugin/templates/typescript.jsView file
4const dockerfile = 'FROM --platform=$BUILDPLATFORM oven/bun:1.3.0-alpine AS builder\n\n# Multi-platform build arguments\nARG TARGETOS\nARG TARGETARCH\n\nWORKDIR /build\n\n# Copy pa...
L5: const cursorRules = "---\ndescription: {name} Plugin Guide\nglobs: src/**\nalwaysApply: false\n---\n\n# {name} Plugin Development Guide\n\nYou are an expert in developing Cosmo Rou...
L6: const debugBuild = '#!/bin/sh\nDIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)\n\nWG_BUN_DEBUG="true" exec bun --inspect run "$DIR/../src/plugin.ts" "$@" 2>>"$DIR/plugin_stderr.lo...
L7: const grpcHealthCheckFilePatch = "diff --git a/build/src/health.js b/build/src/health.js\nindex [redacted]..[redacted] 1...
L8: const packageJson = '{\n "name": "plugin-bun",\n "version": "1.0.0",\n "description": "gRPC Plugin us
High
Findings
5 High4 Medium6 Low
HighChild Process
HighShelldist/src/core/plugin-publish.js
HighSame File Env Network Executiondist/src/commands/router/commands/plugin/templates/typescript.js
HighSandbox Evasion Gated Capabilitydist/src/core/telemetry.js
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/src/commands/router/commands/plugin/commands/init.js
MediumDynamic Requiredist/src/commands/router/commands/plugin/templates/typescript.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowEvaldist/src/commands/router/commands/plugin/templates/typescript.js
LowFilesystem
Low
Affected versions and remediation
This report applies to wgc@0.129.9.
See all versions of wgc for other recorded verdicts.
- Review the evidence and your use of wgc@0.129.9 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.