wgc@0.130.4
The official CLI tool to manage the GraphQL Federation Platform Cosmo
AI Security Review
scanned 2mo ago · by lpm-firewall-aiNo malicious install-time behavior is present, but the package has an explicit AI-agent configuration write and a remote download-and-execute path. These capabilities warrant a warning rather than a publication block.
Static reason
One or more suspicious static signals were detected.
Trigger
Running wgc router plugin init or wgc router plugin generate.
Impact
A user can receive generated AI-agent rules; a changed remote installer could execute with that user's permissions.
Mechanism
Explicit project scaffolding, telemetry capture, and remote shell-script execution.
AI rationale
No malicious install-time behavior is present, but the package has an explicit AI-agent configuration write and a remote download-and-execute path. These capabilities warrant a warning rather than a publication block.
Evidence
dist/src/commands/router/commands/plugin/commands/init.jsdist/src/commands/router/commands/plugin/toolchain.js<selected project>/.cursor/rules/plugin-development.mdc<selected project>/config.yaml<Cosmo data directory>/proto-tools/download/install-proto-tools.sh
Network endpoints2
eu.i.posthog.comraw.githubusercontent.com/wundergraph/cosmo/refs/tags/wgc%400.96.0/scripts/install-proto-tools.sh
Decision evidence
public snapshotAI called this Suspicious at 83.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The CLI sends command names, options, and arguments to telemetry when a command runs.
- The explicit plugin init command writes Cursor rule files into the selected project.
- The plugin tool installer downloads a shell script and executes it without an integrity check.
Evidence against
- The manifest has no preinstall, install, or postinstall lifecycle hook.
- The Cursor write is behind the named plugin init command, not package installation.
- The tool download is reached through an explicit generate command.
Behavioral surface
CryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsMinifiedTelemetryUrlStrings
Source & flagged code
4 flaggeddist/src/core/telemetry.jsView file
9// Support for COSMO_TELEMETRY_DISABLED and Console Do Not Track standard
L10: const TELEMETRY_DISABLED = process.env.COSMO_TELEMETRY_DISABLED === 'true' || process.env.DO_NOT_TRACK === '1';
L11: const UNAUTHENTICATED_CONTEXT_METADATA = Object.freeze({ organizationId: 'anonymous' });
...
L20: // This will also make the retry mechanism ineffective.
L21: async function safePostHogFetch(url, options) {
L22: try {
...
L40: const isCI = () => {
L41: return Boolean(process.env.CI || // Travis CI, CircleCI, GitLab CI, GitHub Actions, etc.
L42: process.env.CONTINUOUS_INTEGRATION ||
...
L163: var _a;
L164: const machineId = crypto.hash('sha256', os.hostname(), 'hex');
L165: return {
High
Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
dist/src/core/telemetry.jsView on unpkg · L9dist/src/commands/router/commands/plugin/commands/init.jsView file
•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation.
}
}
const proto = compilegraphqltoproto(plugintemplates.schemagraphql, {
servicename,
packagename: 'service',
protooptions,
});
await writefile(resolve(generateddir, 'service.proto'), proto.proto);
await writefile(resolve(generateddir, 'service.proto.lock.json'), json.stringify(proto.lockdata, null, 2));
let readmetemplate = '';
let mainfilename = '';
await mkdir(resolve(tempdir, '.cursor', 'rules'), { recursive: true });
switch (options.lang
Findings
3 High4 Medium5 Low
HighSandbox Evasion Gated Capabilitydist/src/core/telemetry.js
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/src/commands/router/commands/plugin/commands/init.js
HighSemantic Analysis Limiteddist/package.json
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumAi Review Evidencedist/src/commands/index.js
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to wgc@0.130.4.
See all versions of wgc for other recorded verdicts.
- Review the evidence and your use of wgc@0.130.4 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.