wgc@0.131.0
The official CLI tool to manage the GraphQL Federation Platform Cosmo
AI Security Review
scanned 25d ago · by lpm-firewall-aiThe manifest exposes an ordinary CLI entry point without an install lifecycle hook. Source inspection shows the agent-rule write is an explicit, project-local scaffolding action, and the telemetry fingerprint signal does not establish hidden behavior.
Static reason
One or more suspicious static signals were detected.
Trigger
The CLI runs when invoked; plugin scaffolding runs only when its initialization command is selected.
Impact
No unconsented install-time mutation, credential theft, or hidden execution was established.
Mechanism
The initialization command creates rules inside the generated project. Telemetry can be disabled and sends usage events to the configured PostHog host.
AI rationale
The manifest exposes an ordinary CLI entry point without an install lifecycle hook. Source inspection shows the agent-rule write is an explicit, project-local scaffolding action, and the telemetry fingerprint signal does not establish hidden behavior.
Evidence
dist/src/commands/router/commands/plugin/commands/init.jsdist/src/core/telemetry.js
Network endpoints1
eu.i.posthog.com
Decision evidence
public snapshotAI called this Clean at 92.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json exposes a CLI entry point; its scripts show build tooling and no install lifecycle hook.
- Telemetry is opt-out and sends usage events through PostHog; the inspected source does not show CI or host checks enabling hidden execution.
- The flagged agent-rule write runs during an explicit plugin initialization command and targets the generated project directory.
- The distributed manifest contains build scripts and no install lifecycle hook.
Evidence against
Behavioral surface
CryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsMinifiedTelemetryUrlStrings
Source & flagged code
4 flaggeddist/src/core/telemetry.jsView file
9// Support for COSMO_TELEMETRY_DISABLED and Console Do Not Track standard
L10: const TELEMETRY_DISABLED = process.env.COSMO_TELEMETRY_DISABLED === 'true' || process.env.DO_NOT_TRACK === '1';
L11: const UNAUTHENTICATED_CONTEXT_METADATA = Object.freeze({ organizationId: 'anonymous' });
...
L20: // This will also make the retry mechanism ineffective.
L21: async function safePostHogFetch(url, options) {
L22: try {
...
L40: const isCI = () => {
L41: return Boolean(process.env.CI || // Travis CI, CircleCI, GitLab CI, GitHub Actions, etc.
L42: process.env.CONTINUOUS_INTEGRATION ||
...
L163: var _a;
L164: const machineId = crypto.hash('sha256', os.hostname(), 'hex');
L165: return {
High
Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
dist/src/core/telemetry.jsView on unpkg · L9dist/src/commands/router/commands/plugin/commands/init.jsView file
•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation.
}
}
const proto = compilegraphqltoproto(plugintemplates.schemagraphql, {
servicename,
packagename: 'service',
protooptions,
});
await writefile(resolve(generateddir, 'service.proto'), proto.proto);
await writefile(resolve(generateddir, 'service.proto.lock.json'), json.stringify(proto.lockdata, null, 2));
let readmetemplate = '';
let mainfilename = '';
await mkdir(resolve(tempdir, '.cursor', 'rules'), { recursive: true });
switch (options.lang
Findings
3 High3 Medium6 Low
HighSandbox Evasion Gated Capabilitydist/src/core/telemetry.js
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/src/commands/router/commands/plugin/commands/init.js
HighSemantic Analysis Limiteddist/package.json
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
Affected versions and remediation
This report applies to wgc@0.131.0.
See all versions of wgc for other recorded verdicts.
- Review the evidence and your use of wgc@0.131.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.