wgc@0.131.1
The official CLI tool to manage the GraphQL Federation Platform Cosmo
AI Security Review
scanned 25d ago · by lpm-firewall-aiThe inspected manifest and published dist manifest expose a CLI but no install lifecycle hook. The flagged project-file writes are part of explicitly invoked scaffolding, while telemetry is opt-out and uses a configurable PostHog host; the scanner hints do not establish malicious behavior.
Static reason
One or more suspicious static signals were detected.
Trigger
Plugin scaffolding requires invoking the CLI init command; telemetry requires CLI initialization and an enabled capture call.
Impact
No confirmed malicious or unconsented attack surface was established.
Mechanism
The initializer writes generated project files under the chosen project directory. Telemetry uses PostHog with an opt-out gate and an environment-configurable host.
AI rationale
The inspected manifest and published dist manifest expose a CLI but no install lifecycle hook. The flagged project-file writes are part of explicitly invoked scaffolding, while telemetry is opt-out and uses a configurable PostHog host; the scanner hints do not establish malicious behavior.
Evidence
dist/src/commands/router/commands/plugin/commands/init.js
Network endpoints1
eu.i.posthog.com
Decision evidence
public snapshotAI called this Clean at 88.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json exposes the CLI entrypoint and contains no preinstall, install, or postinstall hook.
- dist/package.json matches the package entrypoint and contains no install lifecycle hook.
- Plugin scaffolding is activated by an explicit CLI command and writes generated project files.
- Telemetry uses the configured PostHog endpoint and can be disabled with standard opt-out variables.
Evidence against
Behavioral surface
CryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsMinifiedTelemetryUrlStrings
Source & flagged code
4 flaggeddist/src/core/telemetry.jsView file
9// Support for COSMO_TELEMETRY_DISABLED and Console Do Not Track standard
L10: const TELEMETRY_DISABLED = process.env.COSMO_TELEMETRY_DISABLED === 'true' || process.env.DO_NOT_TRACK === '1';
L11: const UNAUTHENTICATED_CONTEXT_METADATA = Object.freeze({ organizationId: 'anonymous' });
...
L20: // This will also make the retry mechanism ineffective.
L21: async function safePostHogFetch(url, options) {
L22: try {
...
L40: const isCI = () => {
L41: return Boolean(process.env.CI || // Travis CI, CircleCI, GitLab CI, GitHub Actions, etc.
L42: process.env.CONTINUOUS_INTEGRATION ||
...
L163: var _a;
L164: const machineId = crypto.hash('sha256', os.hostname(), 'hex');
L165: return {
High
Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
dist/src/core/telemetry.jsView on unpkg · L9dist/src/commands/router/commands/plugin/commands/init.jsView file
•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation.
}
}
const proto = compilegraphqltoproto(plugintemplates.schemagraphql, {
servicename,
packagename: 'service',
protooptions,
});
await writefile(resolve(generateddir, 'service.proto'), proto.proto);
await writefile(resolve(generateddir, 'service.proto.lock.json'), json.stringify(proto.lockdata, null, 2));
let readmetemplate = '';
let mainfilename = '';
await mkdir(resolve(tempdir, '.cursor', 'rules'), { recursive: true });
switch (options.lang
Findings
3 High3 Medium6 Low
HighSandbox Evasion Gated Capabilitydist/src/core/telemetry.js
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/src/commands/router/commands/plugin/commands/init.js
HighSemantic Analysis Limiteddist/package.json
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
Affected versions and remediation
This report applies to wgc@0.131.1.
See all versions of wgc for other recorded verdicts.
- Review the evidence and your use of wgc@0.131.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.